Hackers’ project disguises security-busting code