Loading malware…
SmartLoader is a Windows malware loader used in large-scale fake GitHub repository campaigns, notably FakeGit and the AI-themed AgentBaiting activity. It is commonly delivered through counterfeit or cloned repositories that impersonate legitimate developer tools, AI resources, skills, and Model Context Protocol servers, where README instructions direct victims to download ZIP archives posing as installers or releases. Earlier activity also tied the broader operation to ClickFix-style social engineering.
Observed SmartLoader packages use a LuaJIT-based execution chain consisting of a launcher script, a renamed interpreter or runtime component, and an obfuscated Lua payload disguised as a benign text-like file. The loader executes the concealed Lua code in memory, a design that helps evade simple file-by-file scanning and sandbox triage. Analysis of different stages has linked the obfuscation to Prometheus-style and MoonSec-style Lua protection in separate samples.
Once active, SmartLoader performs host reconnaissance, including geolocation checks and collection of basic system details, and has been observed capturing a desktop screenshot before beaconing. It resolves command-and-control infrastructure dynamically from a Polygon smart contract using an EtherHiding-style mechanism, allowing operators to rotate infrastructure without changing the malware binary. SmartLoader then exchanges encrypted configuration and tasking with its operators, downloads additional encrypted stages from GitHub, and can establish persistence through scheduled tasks. Multiple reports describe a redundant multi-stage chain in which SmartLoader retrieves further Lua-based stages and ultimately delivers follow-on payloads.
SmartLoader is primarily a delivery mechanism for secondary malware rather than the final monetization payload. In observed campaigns it has delivered information stealers including StealC, Lumma Stealer, Vidar, Rhadamanthys, and a NodeJS-based malware-as-a-service infostealer. Some reporting also describes follow-on process injection associated with StealC deployment. The campaigns using SmartLoader have targeted AI users, developers, and organizations in sectors including financial services, banking, and technology, with victims reported across North America, Asia, and Southern Europe.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Together, the four files make up SmartLoader, a malware loader Netskope has previously seen distributed through GitHub repositories.
There has been an extensive malware campaign, dubbed FakeGit, that utilizes thousands of counterfeit GitHub repositories to distribute SmartLoader malware... Upon activation, the attack launches a LuaJIT-based loader that launches an obfuscated Lua script to install SmartLoader.
A newly documented campaign called AgentBaiting uses fraudulent AI Skills and Model Context Protocol, or MCP, servers to distribute SmartLoader malware through trusted-looking GitHub projects and public capability catalogs.
24 distinct techniques documented for this family, organized by ATT&CK tactic.
The Trivy breach and SmartLoader MCP spoofing incidents in 2026 have already highlighted the tools developers trust implicitly are also being actively targeted.
After installation, SmartLoader creates persistence using scheduled tasks...
The SmartLoader used a scheduled task for persistence with a randomized execution time and task name.
Despite its name, compiler.exe is a renamed LuaJIT interpreter. The batch script launches compiler.exe with gc.txt as an argument, causing the interpreter to read and execute the contents of the text file.
compiler.exe is a renamed LuaJIT interpreter... causing the interpreter to read and execute the contents of the text file
the Prometheus virtual machine reconstructs the malicious code from an encrypted string pool... Static analysis linked its obfuscation to MoonSec
To deceive developers, attackers clone well-known repositories and subtly integrate malicious payloads. They usually add the payload to a benign-looking subdirectory or modify the URLs on the installation instructions. Because the root page appears authentic and the original contributor is listed, victims are lured into trusting the GitHub page...
SmartLoader starts by sending a GET request... querying a smart contract through public RPC providers to get the address to contact... Before reporting in, SmartLoader takes a screenshot... sent together with an encrypted beacon
SmartLoader starts by sending a GET request to ip-api.com/json... After resolving the C2 IP address, SmartLoader constructs a multi-part HTTP POST.
This serves as a dead drop resolver for the attacker, where updating the contract values changes the target C2 address without requiring any modification on the malware.
The response carries encrypted configuration data and a task list, which in this case instructed SmartLoader to download the second stage
26 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
27 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A multi-file malware loader delivered via cloned GitHub repositories. It uses a renamed LuaJIT interpreter and a text-based payload to evade detection, gathers victim geolocation data, takes screenshots, resolves C2 via the Polygon blockchain using EtherHiding, and downloads a second-stage payload that ultimately delivers an infostealer.
A multi-stage malware loader distributed via trojanized or impersonated GitHub repositories. It performs geolocation reconnaissance, captures screenshots, resolves C2 infrastructure at runtime from the Polygon blockchain using EtherHiding, beacons to C2 with encrypted data, establishes persistence, and downloads/executes second-stage and final payloads including infostealers.
Referenced only as a background example of another AI-themed malware lure.
Related Articles: ... FakeGit campaign uses 7,600 GitHub repos to push SmartLoader malware ...
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.