Fake Security Tools on GitHub Run Code When You Build Them

Doctor Web counted 2,000+ infected PCs. How the .suo and PreBuildEvent tricks work, what Trojan.Loader.3261 disables, and how to check a repo first.