Loading malware…
SmartLoader is a Windows malware loader used in large-scale fake GitHub repository campaigns, including the FakeGit and AgentBaiting operations. It is commonly delivered through trojanized ZIP archives embedded in cloned or impersonated developer projects, especially AI tools, developer utilities, game cheats, and Model Context Protocol or AI skill lures. Typical delivery packages contain a batch launcher, a renamed LuaJIT interpreter or runtime components, and a heavily obfuscated Lua payload disguised as a text or log file. Execution of the launcher starts the Lua-based stager, allowing the malware to blend into seemingly legitimate project files and evade simplistic file-based inspection.
SmartLoader is characterized by its LuaJIT-based staging architecture, extensive obfuscation, and dynamic command-and-control discovery. Multiple analyses associate its first-stage scripts with Prometheus-style Lua obfuscation, while later stages have shown indicators consistent with MoonSec. The malware uses anti-debugging and anti-tamper logic, suppresses visible console windows, fingerprints the host, performs internet and geolocation checks, and captures screenshots. It can exfiltrate host metadata and screenshots to its operators and uses the Polygon blockchain as a dead-drop resolver for command-and-control information, enabling operators to rotate infrastructure without rebuilding the malware.
Persistence is commonly established through Windows scheduled tasks, including redundant recovery paths that can relaunch a cached local stage or re-download encrypted stages from GitHub. SmartLoader also retrieves additional encrypted payloads from attacker-controlled GitHub repositories and contains functionality consistent with in-memory loading of follow-on payloads. In observed campaigns, SmartLoader has been used to deliver information stealers including StealC, Lumma Stealer, Vidar Stealer, and a previously reported NodeJS-based malware-as-a-service infostealer. Follow-on payloads have targeted browser credentials, cookies, cryptocurrency wallet data, email-related data, tokens, and other sensitive information.
The malware has been heavily associated with abuse of trust in open-source ecosystems and developer workflows. Campaigns using SmartLoader have impersonated legitimate repositories, copied documentation and project metadata, and leveraged public AI capability catalogs and AI assistants to increase discovery of malicious projects. Victims have been concentrated in North America, Asia, and Southern Europe, with notable targeting of financial services, banking, and technology organizations, although the lures also target individual developers and consumers.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Together, the four files make up SmartLoader, a malware loader Netskope has previously seen distributed through GitHub repositories.
There has been an extensive malware campaign, dubbed FakeGit, that utilizes thousands of counterfeit GitHub repositories to distribute SmartLoader malware... Upon activation, the attack launches a LuaJIT-based loader that launches an obfuscated Lua script to install SmartLoader.
A newly documented campaign called AgentBaiting uses fraudulent AI Skills and Model Context Protocol, or MCP, servers to distribute SmartLoader malware through trusted-looking GitHub projects and public capability catalogs.
31 distinct techniques documented for this family, organized by ATT&CK tactic.
Threat actors are actively targeting public GitHub repositories that share tools such as game cheats, Claude code splitters, AI-powered security camera utilities, Amazon validators, coding extensions, and similar software. Attackers fork or clone legitimate repositories, then upload a malicious SmartLoader payload into them.
Scheduled Tasks: The script also creates schedules task under the following names for persistence. These tasks are configured to execute the malicious Lua script daily at a predetermined time.
The Lua script executes and connects to a Polygon RPC endpoint (leveraging the blockchain network for C2 retrieval).
Launcher.cmd – Command shell script file with command to execute the malicious Lua script using Luajit.exe
compiler.exe is a renamed LuaJIT interpreter... causing the interpreter to read and execute the contents of the text file
Scheduled Tasks: The script also creates schedules task under the following names for persistence. These tasks are configured to execute the malicious Lua script daily at a predetermined time.
Scheduled Tasks: The script also creates schedules task under the following names for persistence. These tasks are configured to execute the malicious Lua script daily at a predetermined time.
The Lua script is heavily obfuscated, and was obfuscated using the Prometheus Lua obfuscator.
The script dynamically loads multiple additional DLLs using ldrloaddll.
In this campaign, the attacker-controlled GitHub repository hosts two XOR encoded distinct payloads
The actor changes only the parts that influence user behavior: the README, the repository metadata, and the embedded archive.
The malware creates a mutex with the following long hardcoded name... This mutex prevents multiple instances of the payload from running simultaneously on the same machine.
After successfully deobfuscating the initial script, several sophisticated anti-debugging and anti-tampering mechanisms became clearly visible.
The payload performs connectivity and geolocation checks before proceeding to C2 communication
In the samples we analyzed, that SmartLoader stage hides execution, performs a native anti-debug check... fingerprints the host, captures a screenshot, exfiltrates the collected data...
The script enumerates the following user-specific directories: C:\Users\BBBB\AppData\Local\Temp\ C:\Users\BBBB\AppData\Roaming\ C:\Users\BBBB\Desktop\
After successfully deobfuscating the initial script, several sophisticated anti-debugging and anti-tampering mechanisms became clearly visible.
The payload constructs and sends a POST request to a Polygon blockchain RPC endpoint (polygon-rpc.com).
Once SmartLoader resolves the active server, it sends a POST request to /api/<base64_victim_id> on the bare-IP C2. The request body is multipart/form-data... The server responds with JSON...
EtherHiding is an advanced evasion and delivery technique in which attackers leverage blockchain networks as an intermediary infrastructure to host and retrieve command-and-control (C2) information and payload locations.
When unsuspecting users download and run the software from these compromised repositories, they unknowingly retrieve and execute the malicious Lua payload alongside the intended files.
148 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
30 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A multi-file malware loader delivered via cloned GitHub repositories. It uses a renamed LuaJIT interpreter and a text-based payload to evade detection, gathers victim geolocation data, takes screenshots, resolves C2 via the Polygon blockchain using EtherHiding, and downloads a second-stage payload that ultimately delivers an infostealer.
A multi-stage malware loader distributed via trojanized or impersonated GitHub repositories. It performs geolocation reconnaissance, captures screenshots, resolves C2 infrastructure at runtime from the Polygon blockchain using EtherHiding, beacons to C2 with encrypted data, establishes persistence, and downloads/executes second-stage and final payloads including infostealers.
Referenced only as a background example of another AI-themed malware lure.
Related Articles: ... FakeGit campaign uses 7,600 GitHub repos to push SmartLoader malware ...
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.