Security researchers find 15 malicious repositories, all deploying a dropper for the WebRAT backdoor.