Hackers Use Fake DeepSeek TUI GitHub Repositories to Deliver Malware

Hackers are once again targeting developers and AI enthusiasts by impersonating popular open-source tools on GitHub. This time, the target is DeepSeek TUI, a legitimate terminal-based intelligent agent that allows users to interact with DeepSeek large language models directly from the command line.

With the recent release of DeepSeek v4 and a widely shared post by developer Hunter Bown generating buzz across Chinese-language tech communities, the project quickly became a high-value spoofing target for threat actors looking to capitalize on trending AI software.

The attack follows a pattern that has grown increasingly common in the developer community. Cybercriminals create convincing fake repositories on GitHub that closely mimic the look and layout of a genuine project.

Unsuspecting users who land on these pages are tricked into downloading what appears to be a legitimate tool. In this case, the malware was hidden inside a 7z compressed archive file sitting on the Releases page of the fraudulent repository, making it look like a standard software download.

Researchers at QiAnXin Threat Intelligence Center were the first to identify this campaign in detail. They noted that the malware’s features are nearly identical to a previously disclosed spoofing attack known as OpenClaw, which QiAnXin exposed in March 2026. The same malicious domain names used in that earlier campaign also appear in this one, pointing to the same threat actor operating in an ongoing and evolving capacity.

What makes this campaign particularly concerning is the sheer number of fake AI-themed installer names tied to the same attack infrastructure. Alongside DeepSeek TUI, researchers found counterfeit files posing as tools named after Claude, Grok, WormGPT, KawaiiGPT, fraudGPT, and several others.

Fake DeepSeek TUI Repository Used as Malware Delivery Point

Based on a shared PDB path called “ClawCode.pdb” found embedded in the samples, all of these malicious executables are linked to the same Rust-written malware family, suggesting a coordinated threat actor constantly rotating spoofing targets.

The primary malware file identified in this campaign is named DeepSeek-TUI_x64.exe, with an MD5 hash of b96c0d609c1b7e74f8cb1442bf0b5418 and a compilation timestamp of April 29, 2026. Before executing any malicious behavior, it runs an extensive environment check to determine whether it is running inside a sandbox.

If it detects signs of a virtual machine, known analysis tools, or suspicious system characteristics, it displays the message “Sorry, your system does not meet the minimum requirements” and quietly exits.

Once the malware confirms it is running on a real user machine, it proceeds to disable key Windows Defender protections using an XOR-encrypted PowerShell script.

It adds six folder exclusions, disables cloud-based reporting, turns off behavior monitoring, and opens three inbound firewall ports: 57001, 57002, and 56001. The string decryption key used in the sample is “xnasff3wcedj,” and the malware reaches out to Pastebin and snippet.host links to fetch Azure-hosted second-stage payloads.

The downloaded second-stage components each serve a specific role in maintaining the attacker’s access. OneSync.exe and WinHealhCare.exe handle installation and scheduled task setup while reporting back via Telegram.

The component onedrive_sync.exe ensures persistence through the Windows Run registry key. Meanwhile, svc_service.exe acts as the resident core, using NT syscalls for thread injection and loading .NET assemblies entirely in memory to avoid detection.

Multi-Stage Persistence and Anti-Sandbox Evasion

The campaign’s use of multiple persistence mechanisms makes it especially difficult to remove once a system is compromised. The malware can survive through scheduled tasks, registry Run keys, Winlogon hooks, and startup shortcuts.

The second-stage loader autodate.exe masquerades as a service manager while quietly injecting payloads into memory. The C2 domains used are mikolirentryifosttry.info and zkevopenanu.cfd.

Developers and security teams are strongly advised to verify the authenticity of any GitHub repository before downloading files, especially for AI-related tools that have gained sudden public attention.

Always check account age, commit history, and the number of genuine contributors before trusting a release. Endpoint detection tools that monitor memory injection techniques and unusual PowerShell activity can also help flag this type of threat early.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.