Science & Tech · Cybersecurity · 2 days ago
FakeGit campaign spreads SmartLoader through 17,610 GitHub repositories
The FakeGit campaign has resumed on GitHub, where researchers found 17,610 repositories distributing SmartLoader.
The campaign uses repository pages with convincing instructions and a download button that leads to a ZIP file containing the malware.
SmartLoader can then deliver other malware, including StealC, which steals information.
Many repositories present themselves as AI skills or MCP servers, making them look like tools developers may want to use.
Researchers say the campaign resumed on October 4 and added more than 13,000 repositories in 34 hours.
The operation is hard to stop because attackers can change download links or use backup files while keeping repositories active.
Users are advised to check who owns a repository and get AI tools from official registries or vendor repositories.
If SmartLoader may have run, users should treat it as a possible account compromise, revoke active sessions and access tokens, and consider using passkeys.
The FakeGit campaign is distributing SmartLoader malware through 17,610 malicious GitHub repositories, according to researchers at Apiiro.
The campaign resumed on October 4 and created more than 13,000 repositories in 34 hours.
SmartLoader is an initial payload used to distribute other malware, including the StealC infostealer.
The repositories use convincing README files with download buttons that link to ZIP archives.
Apiiro advises users to verify repository owners and use official sources for software, AI skills and MCP servers.
- Who
- The FakeGit campaign’s operators are distributing the malware; researchers at Apiiro reported the activity.
- What
- The campaign uses GitHub repositories to distribute SmartLoader, which can deliver other malware, including StealC.
- When
- Apiiro said the campaign resumed on October 4. Researchers observed more than 13,000 repositories created in 34 hours.
- Where
- GitHub.
- Why
- Not stated
This story does not have two clearly opposing sides.
In the commits we sampled, 97% touched only the README, and 88% pointed its “Download” button at a ZIP that installs SmartLoader
Nobody had to create a single new repo. The fleet was already there. It just got re-aimed
71% of the fleet was missing from URLhaus before our report, and a domain-level DNS blocklist can’t block one file on GitHub without blocking GitHub
Delete one file and the operator can point the lure at a spare copy: a fork, an older ZIP, a release asset or an issue attachment
Researchers at Island published a report on 7,600 fake GitHub repositories pushing SmartLoader, and the FakeGit name became associated with the operation.
Apiiro said the FakeGit campaign resumed its activity.
The campaign pushed more than 13,000 repositories, peaking at 2,999 an hour.
BleepingComputer reported that the campaign was using 17,610 GitHub repositories.
- Malicious repositories
- 17,610 on GitHub
- Campaign activity resumed
- October 4
- Repository surge
- More than 13,000 in 34 hours
- Peak rate
- 2,999 repositories an hour
- Accounts linked to legitimate developers
- At least 700
- Earlier Island report
- 7,600 fake repositories
Sources
Related news
Canadian cybersecurity negotiator arrested in ShinyHunters investigation
US seizes two China-linked hacking tools used against critical infrastructure
Canadian cybersecurity executive arrested on extortion-related charges
Security Affairs launches weekly AI and cybersecurity newsletter
Anthropic offers free AI vulnerability scans to open-source projects
FBI arrests another suspect linked to ShinyHunters jobs-site breach
AI agents push identity security to the forefront for companies
AnyDesk Linux flaw allowed attackers to gain root access without approval
Attackers exploit AhsayCBS flaws to install webshells and crypto miners
Organizations urged to prepare for quantum-resistant encryption
Allied alert details cyber tactics linked to sanctioned Chinese group
