FakeGit

FakeGit is a large-scale malware-distribution operation that uses deceptive GitHub repositories to deliver SmartLoader and the StealC infostealer. Its operators impersonate legitimate software projects and developers, copy genuine project files and descriptions, manipulate stars and forks, and publish convincing installation instructions that direct users to malicious ZIP archives. An October 2026 snapshot verified 17,610 live lure repositories. The operation uses both disposable accounts and compromised developer accounts, including accounts used to plant malware in collaborators’ repositories. Its operators’ identities, geographic origin, and state affiliation are not established. FakeGit prominently targets developers seeking software utilities, AI-agent skills, and Model Context Protocol servers. Its lures appear in public software and AI-tool directories, increasing their visibility to users and AI assistants. Some skill-installation workflows can copy malicious archives onto developer machines, but this does not itself execute the malware. The operation also reuses existing repositories by changing README download links in coordinated updates, a technique known as RePointing. The malicious archives use a LuaJIT interpreter to execute obfuscated Lua code. SmartLoader conceals its launcher window, profiles the victim system, establishes persistence through Windows Task Scheduler, retrieves command-and-control information from a Polygon smart contract, and downloads additional components from GitHub. The attack chain ultimately delivers StealC through process injection. StealC steals saved passwords and authenticated browser sessions, enabling abuse of compromised accounts without a fresh login or MFA challenge. Payload copies distributed across forks, release assets, attachments, and linked repositories complicate removal, while obfuscation and instructions to bypass Windows SmartScreen support detection avoidance and execution.