Fake GitHub security tools are spreading malware that disables defenses, steals sensitive data and infects over 2,000 PCs.