Loading story…
The FakeGit malware campaign resumed activity on October 4, using 17,610 malicious GitHub repositories to distribute SmartLoader, which subsequently delivers malware including the StealC infostealer. Repositories masquerade as AI skills or Model Context Protocol (MCP) servers, attracting developers and users seeking legitimate tools. Convincing README files feature download buttons that redirect visitors to malicious ZIP archives. Apiiro researchers observed more than 13,000 repositories created within 34 hours, while the operation also reused and updated an existing repository fleet.
Incomplete repository removal, redundant payload copies across GitHub, and attackers’ ability to redirect existing repositories to new payloads allow the campaign to survive individual takedowns and undermine static blocklists. Researchers recommend verifying repository owners and obtaining AI skills, MCP servers, and other software from official sources rather than trusting polished README files. Organizations should treat suspected SmartLoader execution as a potential GitHub account compromise and investigate affected accounts and endpoints.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
FakeGit resumed activity on October 4, using a fleet of 17,610 GitHub repositories to distribute SmartLoader and ultimately the StealC infostealer. Convincing README instructions and download buttons directed users to malicious ZIP archives.
Apiiro identified at least 700 associated accounts that appeared to belong to legitimate developers and reported that 71% of the repository fleet was absent from URLhaus before its report. Researchers also found redundant malicious archives across GitHub, allowing the operator to replace removed payload links with spare copies while keeping repositories active.
The operator pushed changes across more than 13,000 existing repositories within 34 hours, peaking at 2,999 repositories per hour. Apiiro found that 97% of sampled commits changed only the README and 88% redirected its download button to a ZIP archive that installs SmartLoader.
In July, Island researchers associated the FakeGit name with an operation using 7,600 fake GitHub repositories to distribute SmartLoader. They reported that 800 repositories masqueraded as AI skills or MCP servers and appeared in public AI registries and catalogs.
Researchers observed similar malicious GitHub repository activity involving various payloads since at least January. The operation was subsequently associated with the FakeGit name.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a large-scale GitHub malware distribution campaign that has operated since March 2025, using repositories masquerading as cracked browser extensions, gaming cheats, developer tools, and, more recently, fake AI skills and MCP servers. The activity has been tied to a Vietnamese-speaking operator and spans more than 47 GitHub accounts and 600 malicious ZIP archives, with some accounts believed to have been compromised rather than created solely for abuse. The campaign’s social-engineering lures target both general users and developers seeking unofficial software, automation tools, or AI-related components. The repositories deliver a multi-stage **LuaJIT** loader chain that ultimately installs the **StealC** information stealer. Payloads are fetched from GitHub “dead drop” repositories, then decrypted through layered obfuscation including hex, XOR, `base64url`, and **AES-ECB** before process hollowing is used for injection. Researchers said the malware also resolves command-and-control infrastructure through **Polygon Mainnet** smart contracts, allowing operators to rotate C2 URLs or IPs without changing deployed binaries; telemetry linked the activity to detections such as BitDefender `Gen:Heur.FakeGit.1` and ESET’s `Lua/Agent` family, while infrastructure usage heavily overlapped with bulletproof hosting providers including **ASN 207957 (Serv.host Group Ltd)**.
Jul 22, 2026
Security researchers reported a **FakeGit** campaign using counterfeit GitHub repositories to trick developers into downloading trojanized tools, with Magento developers among the primary targets. The repositories copied code, commit history, and project structure from legitimate open-source deployment, Docker, and configuration projects so that authentic contributor names appeared alongside the fake repos, increasing credibility. Victims were directed to download ZIP archives that contained a LuaJIT runtime, a batch launcher, and obfuscated Lua payloads that installed Windows malware, including a remote access trojan and keylogger; Sansec also published malicious GitHub accounts, repository names, and SHA1 hashes tied to the operation. A related lure expanded the campaign beyond Magento by impersonating a security automation project named **`n8n-CyberSecurity-Workflows`**, targeting red team, blue team, and AppSec users with GitHub stars, an MIT license, and a README download button. Analysis of the downloaded archive found a Lua-based trojan loader using DLL sideloading through a renamed Lua 5.1 interpreter to execute obfuscated bytecode, with VirusTotal detections labeling the payload as **`trojan.fakegit/runner`**. The malware was also observed contacting a Polygon blockchain RPC endpoint, behavior researchers said aligns with crypto-clipper or wallet-drainer activity, indicating the FakeGit operation is using trusted developer platforms to distribute credential theft and broader financially motivated malware.
Aug 14, 2026
Threat actors abused GitHub to distribute malware by cloning legitimate repositories, impersonating trusted open-source projects, and poisoning search results to steer victims to trojanized downloads. One campaign spoofed the **AIMMY** game-cheat project through a cloned repository and the lookalike site `aimmy.app`, while also exploiting GitHub's issue-draft upload behavior to host malicious files on the original benign repository via direct links that appeared trustworthy. The delivered packages included files such as `Aimmy.bat`, `AimmyLauncher.exe`, `lua51.dll`, and supporting data, with the malware implemented through obfuscated **LuaJIT** code. Follow-on analysis tied similar GitHub repo poisoning activity to **SmartLoader**, which used trojanized `lua51.dll` components and heavily obfuscated Lua payloads to deploy **StealC** infostealer. The malware performed anti-debugging and anti-tamper checks, captured screenshots, verified connectivity and geolocation, and fetched additional payloads from attacker-controlled GitHub repositories. Researchers found it also used the **EtherHiding** technique, querying the Polygon PoS blockchain for dynamically updated command-and-control data, before exfiltrating browser credentials, cookies, cryptocurrency wallet information, and email data to attacker infrastructure including `213.176.72[.]200`.
Aug 15, 2026