647 stars in three days, then the whole account gone: a "free DeleteMe" open-source library that was actually phishing
What it is A tool that calls itself free, local and portable for Windows (Unlisted), which uses your email address to send GDPR / CCPA deletion requests to 970 data brokers. In reality it's a malware bait repo pushed up by star farming.
Why it blew up It never really caught fire: the stars and forks came from batch-created fake accounts, and star-tracking chart sites and repost accounts auto-amplified the count, manufacturing fake heat of "600 stars in two days". GitHub took it down after 3 days.
DHow to play it Don't go after it head-on. If you really want this niche, compete on what it lacks most: trust. Don't ship an exe, make everything auditable, show users the exact request before it's sent, or fill the countries and laws that real projects like eraser don't cover. Share real deletion results on r/privacy and Show HN.
- Data (updated daily) · repo created 2026-11-03 · 647 stars
GitHub · stars Data 2026-11-05 → 2026-11-06 (2 days, 2 observations). Points before 10-28 come from deeply / archive backfill, not every day has one
Built in 2026 Nov 3, personal-data-deletor-osint hit 554 stars in two days and 647 stars by day three, with a 17% fork rate, and even got recommended in a tech weekly. It claimed it could file data-deletion requests with 970 data brokers for free. In Nov 6, both the repo and the author's account vanished from GitHub. Here's where those stars came from, who the project was baiting, and how to build an open-source project in this niche if you actually want to.
A newsletter recommendation
In Nov 5, the tech site bitdoze's daily digest had this entry: "Two days, 600 stars, a portable Windows tool that sends deletion requests to around 970 data brokers. No account, no server, nothing runs anywhere except your computer." It added a sensible caveat: "Only the README proves it so far, so review what it sends before letting it send anything."
That recommendation wasn't from someone who read the project; it was auto-picked up because the stars were climbing fast. Other sites that featured it at the same time included tierlist.tech, Just Arrived, and Repostream, all "star-tracking" services, plus the Instagram and YouTube accounts that specialize in reposting GitHub trending: git.clipper and LookOnThisGit. Two YouTube Shorts drew 4 and 26 views.
The next day, github.com/brightsongwrath/personal-data-deletor-osint returned 404, and the brightsongwrath account couldn't be found either. Only forks other people had made were still around.
What it says it is
In the README it's called Unlisted, and it's polished: a looping GIF on the first screen where a column of data-broker names changes from "not started" to "pending" to "deleted" and then gets struck through; the headline "They sell your data. Make them stop."; badges reading "$0 forever", "970 brokers", "install: unzip and run".
The selling points, laid out one by one:
- Sends requests from your own email, automatically picking GDPR, UK GDPR, CCPA or other state law based on where you live;
- Tracks each broker's deadline (GDPR one month, CCPA 45 days) and rechecks every 90 days;
- Reads broker replies, and can plug in a local model (Ollama, LM Studio) or your own OpenAI / Anthropic key;
- Uses Sherlock's site list to check your username across 462 websites for data-breach exposure;
- A comparison table: paid services cost $96–129 a year, this one is free. It also cites a real figure: California's official free deletion tool DROP got 500k sign-ups in its first eight months.
The list of 970 brokers is public data repackaged: the California Data Broker Registry, plus the lists from the open-source projects digisamroc/eraser (750+ brokers, MIT license) and Scrubbr.
The flaw is in the "how to install" section
The README tells you to download a zip, and in its own words it contains: Main.exe, its update settings, and the Unlisted runtime; "Main.exe is code-signed, so Windows won't show a warning when it opens. Put Unlisted next to it: they're released together."
Two problems. First, the packaging config in the repo's package.json produces a single file called Unlisted-version-portable-x64.exe, and it explicitly says it's unsigned. The source code can't even produce the zip the README describes. Second, "a legitimately signed exe + its update config + a file that must sit in the same directory" is the textbook DLL side-loading setup: the signed program is real, but on startup it loads the swapped-out file sitting next to it, and the trojan runs inside that.
The security firm Arctic Wolf published a report in July 2026 describing exactly this trick: a fake GitHub repo ships a renamed, legitimately signed WinGUP updater (the one that reads the "update settings" config), plus a tampered libcurl.dll, and runs a BoryptGrab-family infostealer in memory, stealing browser passwords and cookies, crypto wallets, and Discord / Steam / Telegram accounts.
To be clear: the repo has been deleted, the zip in the release can't be obtained, and whether the zip actually contained malware hasn't been directly verified. The points below are circumstantial, but together they're hard to explain any other way.
How the 647 stars came about
The commit history is fabricated. The repo was created on Nov 3 16:47 and pushed in one minute, but the author timestamps on 5 commits are dated between Oct 8 and Nov 2, and every one lands on the 27th second of a minute. The commit messages are template-like, such as "core: the engine, the rules and the main module".
Forks from a batch of farmed accounts. Looking at sister repo watson-username-footprint-finder forked by the same accounts: 55 fork accounts were mostly registered after July 2026, with 0 followers, and their names all use the suffixes GitHub suggests at sign-up: -bot, -hub, -ops, -afk, -design, -maker, -cmyk. Forks came in from 6 a.m. to 9 p.m., 2 to 5 per hour, spread evenly like a scheduled job. The dtvikadt, pj8564472-bot and ik521149-hub accounts also forked personal-data-deletor-osint. They also fork some real trending repos now and then to look like real users.
The star count itself can't be checked (the repo is gone), but by the same method, the stars were bought too.
Stars and downloads are completely decoupled. The sister repo Watson had 436 stars, but its release was downloaded only 21 times.
It's not one repo, it's a series.
Lining up the repos these star-farming accounts forked shows an assembly line: author names made of random English words, one repo per account, freshly created, a few hundred stars. Delete one and they spin up a new account and repost the same theme.
| Theme | Account sequence | stars |
|---|---|---|
| Manual Watson investigation | vaishantsah (10-28, gone after 11-02) → Chipwithinflash (11-03, gone after 11-05) → AtomIllusionistDwell (11-05, still active) | 358 / 576 / 436 |
| Game stutter fix | Centiplatrap (10-31, gone after 11-03) → Badgenyamultiplexer (11-03) | 587 / 320 |
| Valorant frame drop fix | RatioGoldsmithMuse (10-31) → SkinkSmelter6 (11-03) | 233 / 284 |
| Stolen crypto tracker | DolphinStronghold9 (10-30) → PatchBuilderAmplify (11-03) | 141 / 405 |
| Others: free cheat capes, Steam inventory valuation, game accelerators, people-search lookup | One account each | 245–802 |
Data from GitHub daily star records, 10-28 to 11-06.
The themes are all bait favored by infostealer malware: game optimization and cheats, free skins, crypto, people search, privacy tools. brightsongwrath was the "privacy" one in the Nov 3 batch and lasted three days. The README of the Watson repo even tells people directly: when Windows shows the blue warning, click "More info" and then "Run anyway".
The privacy theme is picked with precision: people most worried that "my info got sold" are also the most willing to download an exe that "doesn't upload, doesn't register, only runs on your computer."
Is the demand real, then?
Yes. The bait targets this exact term, which shows people search for it. Paid services DeleteMe (since 2011, about $129/year), Incogni (owned by Surfshark, about $96/year), Optery and Kanary are all doing fine; California's DROP had 500k+ sign-ups in eight months.
But open-source star counts here have stayed low, and that's the benchmark readers should look at:
| Project | Launched | Stars (11-06) | What it does |
|---|---|---|---|
| yaelwrites/Big-Ass-Data-Broker-Opt-Out-List | 2020 | About 7,000 | Manual opt-out checklist, most stars in this theme |
| stephenlthorn/auto-identity-remove | 2026-05 | About 900 | Automatically runs 30+ people-search sites every month |
| digisamroc/eraser | 2026-01 | About 300 | Sends GDPR / CCPA deletion emails to 750+ companies; Unlisted's broker list was taken from it |
| justdelete.me and others | From ¥2013 | A few hundred to 1.5k | Account deletion link directory and deletion scripts |
A new repo that really does the work typically gathers a few hundred stars in this theme over half a year. Getting 600 stars in three days is itself an alarm.
If it were you
Verdict: Stay away. Its 647 stars are bought, and no real user has vouched for the project; what you can learn is how to spot repos like this at a glance, not how to build one.
Who it's for: Developers who already care about privacy and are willing to maintain a broker list over the long run, aiming to build a credible project in the real "open-source DeleteMe" space.
Who it's not for: Anyone trying to copy "hundreds of stars in three days". That path is star-buying plus malware distribution, and the accounts vanish within three days. Nor is it for anyone hoping to get famous quickly from this theme; the realistic ceiling is a few hundred to a thousand stars.
How to do it: This case shows from the other side what this theme's users most lack: the nerve to actually use it. So fill the gap it failed to fill, which is trust: don't ship an exe, make it a command-line tool or something you can run from source in one step; keep the broker list, request templates and legal basis all in the repo where they can be audited; show users the raw email before each request is sent; include reproducible build steps and checksums in the README. Contributing to eraser's list, or covering countries it doesn't (EU member states, UK, Canada, Australia's brokers and laws), is stronger than building another one from scratch.
How to get users: The privacy crowd has real communities: r/privacy, r/PrivacyGuides, Show HN on Hacker News, the Privacy Guides forum. Write up real results like "I used it to send requests to 300 companies, this many replied, this many deleted," which beats any badge. You can also add a line like "there are fakes out there, here's how to tell," since people need that right now.
When to get in: No rush. This kind of theme doesn't depend on a window; it depends on maintaining the list over time. But while "fake deletion tools" are in the news, publishing a piece on how to identify them with your project attached is a handy starting point.
What would mean I got it wrong: If someone later pulls the zip from the release and finds it clean and working, then it was just an ordinary project that bought stars and rushed to launch, and the earlier "phishing" judgment should be withdrawn. Even then, its stars still can't be used as evidence of demand in this theme.
Research notes: competitor table, acquisition evidence, full research report
- Competitors
Name Where Launched Scale How it differs from this one DeleteMe Web 2011 Industry leader, about $129/year Paid removal service; it packages itself as a "free local DeleteMe" Incogni(Surfshark) Web 2022 About $96/year Server-side automatic requests; it claims to be local and free Optery / Kanary / Privacy Bee / Aura / Malwarebytes Personal Data Remover Web 2019-2025 Paid subscription Hosted service; it has users download an exe California DROP Other 2026 8 months, 500k+ sign-ups Official, free, covers all registered brokers at once, California residents only Google's search results about you Big-company features 2022 Global Removes search results only, doesn't touch brokers digisamroc/eraser Open source 2026-01 301 stars / 73 forks Truly open-source email deletion tool, 750+ companies; its broker list was taken from this one stephenlthorn/auto-identity-remove Open source 2026-05 898 stars Automatically runs 30+ people-search sites every month yaelwrites/Big-Ass-Data-Broker-Opt-Out-List Open source 2020 6986 stars Manual opt-out checklist - Where users come from
- Confirmed Fork / star farming (account farm): most forking accounts were registered 2026 years ago, have 0 followers, and carry GitHub's auto-suffixes (-bot/-hub/-ops/-afk/-design/-maker); fork times are evenly spread at 2-5 per hour; the same batch of accounts farmed the whole series (dtvikadt, pj8564472-bot, ik521149-hub and others all forked this repo)
- Confirmed Star-boosting aggregator sites / auto-reposting accounts: bitdoze 11-05 digest, tierlist.tech, Just Arrived, Repostream, Latent Chronicle; Instagram/YouTube git.clipper (4 views), LookOnThisGit (26 views)
- Inferred SEO (free / delete me / CCPA keywords): description and topics are stuffed with keywords; Arctic Wolf says campaigns like this rely on search engines to drive traffic
- Inferred Real-person spread on HN / Reddit / X: x-radar has no hits in the last 30 days, and web search found no real discussion
Research report on brightsongwrath/personal-data-deletor-osint ("Unlisted")
Channel: GitHub | Research date: 2026-11-06 | Data card recall score 82
Bottom line
It's not a product, it's a malware bait repo, so it doesn't count as having "broken out." The 647 stars and 113 forks are numbers produced by an account farm, not users showing up. The repo and the author account have 2026-11-06 disappeared from GitHub (API 404), and the same template and the same batch of star-farming accounts are still pushing a dozen or so other "free Windows utility" repos. Its approach closely matches the "fake GitHub repos distributing BoryptGrab infostealer" that Trend Micro and Arctic Wolf publicly documented 2026 years ago. But we haven't obtained the archive in the release, so the "malicious" part is not yet directly verified.
---
1. What we saw in the data
| Date | stars | fork | Source |
|---|---|---|---|
| 2026-11-03 16:47 UTC | Repo created, all pushed at once | Data card / fork metadata | |
| 2026-11-05 | 554 | 90 | github repo_day |
| 2026-11-06 | 647 | 113 | GitHub repo_day (release tag v0.1.1) |
| 2026-11-06 checked live that day | 404 | 404 | gh api repos/brightsongwrath/... and users/brightsongwrath both return Not Found |
- Two days old and already 554 stars, fork/star ≈ 17%, and the author account has only this one repo.
- The repo is gone, but forks survive (e.g.
dtvikadt/personal-data-deletor-osint, parent pointing to the original). README and code were read from a fork.
2. What it claims to be
The README calls it Unlisted: a portable Windows app that sends GDPR / CCPA deletion requests from your own email to 970 data brokers, tracks deadlines, reads replies (can plug in a local or bring-your-own-key AI), and checks usernames and data breaches. The pitch: "$0 forever, no account, no server, unzip and run."
- The list of 970 brokers is repackaged public data from the California Data Broker Registry, the open-source project Eraser (digisamroc/eraser, 750+ brokers, MIT), and the site lists of Scrubbr and Sherlock (see CREDITS.md).
- The README benchmarks paid services (DeleteMe / Incogni at $96–129 a year) and cites 500k people who signed up for California's DROP in 8 months to argue "the demand is real." The copy is polished, and it admits "not yet tested on real brokers, real Gmail, or real Windows machines."
3. Why I think it's a lure (the evidence chain)
- The installer and the source don't match. The package.json packaging config produces
Unlisted-${version}-portable-x64.exe, withsignAndEditExecutable: false(unsigned). The README, though, tells users to download a zip containing "a signedMain.exe+ its update settings + the Unlisted runtime" and says "they must be placed together." A legitimately signed exe + update config + a companion file that must sit in the same directory is the textbook DLL side-loading setup. Arctic Wolf 2026-07 documented the same tactic: a zip with a renamed, validly signed WinGUP updater, gup.exe (which reads gup.xml, the "update settings" file), plus a tampered libcurl.dll, where the DLL runs an infostealer in memory (Arctic Wolf; related: Trend Micro's BoryptGrab report). - The commit history is fabricated. The repo was created 2026-11-03, yet the author timestamps of its 5 commits span 10-08 to 11-02, and every one lands on a fixed :27 second mark. The commit messages are template boilerplate ("core: the engine, the rules and the main module"). (Source: fork commits API)
- The forks all come from farm accounts. Sampling the 55 forks of sister repo AtomIllusionistDwell/watson-username-footprint-finder: most accounts were created around 2026-07 to November, have 0 followers, and carry GitHub's auto-suggested suffixes (
-bot,-hub,-ops,-afk,-design,-maker,-crypto,-cmyk). Fork times run from 11-05 06 o'clock to 21 o'clock, 2–5 per hour, evenly spread, like a scheduled job. The same batch of accounts (dtvikadt, pj8564472-bot, ik521149-hub, abremaria276-design, maksimmihail863-maker, etc.) all forked personal-data-deletor-osint. They also fork some real popular repos (xerj, AiSOC, useagent, etc.) to make the accounts look like real people. - The same template keeps being re-posted under new accounts. Among the repos these farm accounts forked, the authors all follow the pattern "random English words + one repo + newly created + a few hundred stars," and whenever one gets taken down, a new account reposts it (github repo_profile; a broken last_obs means it disappeared): | Theme | Accounts (in order of appearance) | Stars | |---|---|---| | Watson people search (OSINT) | vaishantsah (gone after 10-28,11-02) → Chipwithinflash (gone after 11-03,11-05) → AtomIllusionistDwell (11-05, still alive) | 358 / 576 / 436 | | Game stutter fix pc-game-fps-doctor | Centiplatrap (gone after 10-31,11-03) → Badgenyamultiplexer (11-03) | 587 / 320 | | Valorant frame drop fix | RatioGoldsmithMuse (gone after 10-31,11-03) → SkinkSmelter6 (11-03) | 233 / 284 | | Stolen crypto tracking | DolphinStronghold9 (gone after 10-30,11-03) → PatchBuilderAmplify (11-03) | 141 / 405 | | Other | SparrowPortray/horizon-free-capes, AssassinCreator/steam-stash-value-report-card, StormSkinkGrip/game-ping-multipath-router, ArcSwordKiln/osint-people-checker | 245–802 |
The themes are all bait that infostealers love: game cheats and optimizers, free skins, crypto, OSINT, privacy tools. brightsongwrath is the "privacy" entry in this series' 11-03 batch, and it was taken down three days later, like its sister repos.
- The sister repo teaches users to bypass system warnings. Watson's README says: "Windows shows a blue warning, click More info, then Run anyway." Its 6.6MB "Electron portable exe" is far too small to be a real Electron app (usually 60MB+). Its release download count is only 21, yet it has 436 stars. The homepage is a
.icudomain (watsonfind.icu). This shows star counts have completely decoupled from real usage.
4. Where users came from (growth tactics)
| Channel | Evidence | Confirmed? |
|---|---|---|
| Star and fork farming (number farms) | See items 3 and 4 in section 3 above: batches of new accounts, an even hourly rhythm, and the same accounts flooding the whole series | Confirmed (fork part). Stars can't be checked directly (the stargazers endpoint returns 404), so inferred from the same pattern |
| Riding GitHub star-aggregator sites for "secondary spread" | The purchased stars triggered a batch of automatic aggregators: bitdoze 11-05 news digest ("600 stars in two days"), tierlist.tech, Just Arrived, Repostream, The Latent Chronicle; and Instagram / YouTube auto-repost accounts git.clipper (Shorts with 4 views) and LookOnThisGit (26 views) | Confirmed. These were reposted automatically based on star counts, and their reach is very small |
| SEO / search | The copy is stuffed with "free, delete me, CCPA, opt-out" keywords, and so are the topics. Arctic Wolf says this kind of campaign mainly relies on search engines to drive traffic | Inferred, not verified |
| Real human discussion on HN / Reddit / X | x-radar finds nothing in the last 30 days, and web search turned up no real human discussion threads | Nothing found |
How the money comes back: campaigns like this monetize by stealing browser passwords and cookies, crypto wallets, and Discord / Steam / Telegram accounts, not by selling software (see Arctic Wolf's analysis of BoryptGrab). This is inferred from similar campaigns; I did not obtain this repo's specific payload.
5. Competitive landscape (the real players in "removing data from data brokers")
| Name | Where | Launched | Scale | How it differs |
|---|---|---|---|---|
| DeleteMe(Abine) | Web subscription | 2011 | Industry leader, about $129/year | Paid, with human-handled removal requests. "It" pitches itself as "a free DeleteMe" |
| Incogni(Surfshark) | Web subscription | 2022 | About $96/year, heavy affiliate marketing | Same, sends requests automatically. "It" pretends to localize and free this |
| Optery, Kanary, Privacy Bee, Aura, Malwarebytes Personal Data Remover | Web subscriptions / security bundles | 2019–2025 | All paid services | All hosted on servers |
| California DROP | Government web maps | 2026 | 8 months, 500k+ sign-ups (cited in its own README) | Free, official, covers all registered brokers in one go, California residents only |
| Google "About your search results" | Big-company features | 2022 | Global | Only removes items from search results, doesn't touch brokers |
| digisamroc/eraser | Open source | 2026-01 | 301 stars / 73 forks | Truly open source, 750+ brokers, GDPR / CCPA emails. "It" took its list directly from this one |
| stephenlthorn/auto-identity-remove | Open source | 2026-05 | 898 stars | Automatically runs 30+ people-search sites every month |
| yaelwrites/Big-Ass-Data-Broker-Opt-Out-List | Open-source list | 2020 | 6,986 stars | Manual opt-out guides, the most-starred in the category |
| justdelete.me, visible-cx/databroker_remover, Scrubbr | Open source | 2013–2026 | Hundreds to 1.5k stars | Directories of account deletion links, deletion tools |
Figures come from the github repos (11-06) and web pages such as the README and PCMag. The category has real demand, and several open-source "free DeleteMe" projects already exist, but they're in the hundreds-of-stars range. A repo with 600 stars in three days is unusual for this category.
6. Differentiation
Its publicly claimed differentiators are "local, free, 970 brokers, AI reads replies, encrypted portable." These selling points are written for the victim: "local portable exe, no account, unzip and run" is exactly the reason someone would download an unfamiliar executable. The "privacy / anti-doxxing" theme also draws in the people who care most about security but are willing to click Run anyway. It got traction not because of its differentiators but because of the star farming.
7. Visibility and copycats
- Visibility: few people know about it. Only automatic aggregators and repost accounts have picked it up. No media, no major accounts, and no public revenue (not applicable).
- Copycats: none. It is itself one member of a series campaign, and the same group is using the same template to re-post under new accounts (see section 3, item 4).
8. What to borrow
- For the recall system: repos matching "author has only one repo, name made of random words, created ≤7 days ago with hundreds of stars, fork/star ≥10%, description like 'Free … for Windows / portable / no account', README asks users to download an exe or zip" should be flagged directly as "suspected malicious lure." Fork accounts carrying GitHub's auto-suffixes (-bot / -hub / -ops / -afk / -cmyk…) are a cheap but strong signal. The existing repo_profile suspect rule (only flags a new single-repo account once it hits ≥3000 stars) is too high a bar, and this whole category slips through.
- For products: the demand for a "free, local DeleteMe" is real (DROP has 500k sign-ups, paid services at $100+ a year). Legitimate approaches to study include digisamroc/eraser and auto-identity-remove. That lures target this topic precisely because the term has search volume.
9. Still unclear
- I didn't obtain the v0.1.1 release archive (the repo was deleted), so whether it contains malware and whether it's a WinGUP + libcurl.dll side-loading setup is not directly verified. The conclusions are inferred from the README description, the fabricated commits, the farm accounts, and the batch takedowns of the series.
- How many stars are fake: can't be checked via the stargazers endpoint, only inferred from the fork accounts.
- Not confirmed whether this group is the same as the BoryptGrab operators in the Arctic Wolf / Trend Micro reports. Only the methods look similar.
Sources
- github repos: repo_day, repo_profile (2026-11-05, 11-06)
- GitHub API:
repos/dtvikadt/personal-data-deletor-osint(README, package.json, CREDITS.md, commits);repos/AtomIllusionistDwell/watson-username-footprint-finder(README, releases, forks); users and repos of each fork account (2026-11-06 checked live) - Arctic Wolf, "Fake GitHub Repositories Deliver BoryptGrab-Lineage Infostealer", 2026-07-13: arcticwolf.com/resources/blog/fake-github-repositories-deliv…
- bitdoze 2026-11-05 digest: www.bitdoze.com/news/2026-11-05/
- git.clipper Instagram: www.instagram.com/reel/DfVnqLJigMy/; YouTube Shorts: www.youtube.com/shorts/Zg0C_9ElWXA, www.youtube.com/shorts/9Wx9WA2mlqw
- PCMag review of data removal services: www.pcmag.com/picks/the-best-personal-data-removal-services