Loading malware…
SmartLoader is a Windows LuaJIT-based malware loader used in the FakeGit and AgentBaiting campaigns, which rely on cloned or counterfeit GitHub repositories impersonating open-source projects, AI tools, developer utilities, AI Skills, and Model Context Protocol servers. Victims are directed by convincing repository documentation to download ZIP archives containing a launcher, a renamed LuaJIT interpreter, and heavily obfuscated Lua payloads disguised as benign text or project files. SmartLoader uses anti-analysis and execution-hiding measures, performs host and geolocation reconnaissance, captures desktop screenshots, and exfiltrates collected metadata and screenshots to command-and-control infrastructure. It uses EtherHiding-style command-and-control resolution via a Polygon smart contract, permitting operators to rotate active infrastructure without altering the loader. SmartLoader establishes persistence through scheduled tasks and retrieves encrypted follow-on stages from GitHub. Observed infection chains have delivered the StealC information stealer and other infostealer payloads. Campaign activity has targeted AI users, developers, and organizations in financial services, banking, and technology, particularly in North America, Asia, and Southern Europe. FakeGit has been assessed as potentially related to an earlier Lumma Stealer operation associated with Water Kurita, although attribution of SmartLoader activity itself remains unconfirmed.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Together, the four files make up SmartLoader, a malware loader Netskope has previously seen distributed through GitHub repositories.
There has been an extensive malware campaign, dubbed FakeGit, that utilizes thousands of counterfeit GitHub repositories to distribute SmartLoader malware... Upon activation, the attack launches a LuaJIT-based loader that launches an obfuscated Lua script to install SmartLoader.
A newly documented campaign called AgentBaiting uses fraudulent AI Skills and Model Context Protocol, or MCP, servers to distribute SmartLoader malware through trusted-looking GitHub projects and public capability catalogs.
31 distinct techniques documented for this family, organized by ATT&CK tactic.
Threat actors are actively targeting public GitHub repositories that share tools such as game cheats, Claude code splitters, AI-powered security camera utilities, Amazon validators, coding extensions, and similar software. Attackers fork or clone legitimate repositories, then upload a malicious SmartLoader payload into them.
Scheduled Tasks: The script also creates schedules task under the following names for persistence. These tasks are configured to execute the malicious Lua script daily at a predetermined time.
The Lua script executes and connects to a Polygon RPC endpoint (leveraging the blockchain network for C2 retrieval).
Launcher.cmd – Command shell script file with command to execute the malicious Lua script using Luajit.exe
compiler.exe is a renamed LuaJIT interpreter... causing the interpreter to read and execute the contents of the text file
Scheduled Tasks: The script also creates schedules task under the following names for persistence. These tasks are configured to execute the malicious Lua script daily at a predetermined time.
Scheduled Tasks: The script also creates schedules task under the following names for persistence. These tasks are configured to execute the malicious Lua script daily at a predetermined time.
The Lua script is heavily obfuscated, and was obfuscated using the Prometheus Lua obfuscator.
The script dynamically loads multiple additional DLLs using ldrloaddll.
In this campaign, the attacker-controlled GitHub repository hosts two XOR encoded distinct payloads
The actor changes only the parts that influence user behavior: the README, the repository metadata, and the embedded archive.
The malware creates a mutex with the following long hardcoded name... This mutex prevents multiple instances of the payload from running simultaneously on the same machine.
After successfully deobfuscating the initial script, several sophisticated anti-debugging and anti-tampering mechanisms became clearly visible.
The payload performs connectivity and geolocation checks before proceeding to C2 communication
In the samples we analyzed, that SmartLoader stage hides execution, performs a native anti-debug check... fingerprints the host, captures a screenshot, exfiltrates the collected data...
The script enumerates the following user-specific directories: C:\Users\BBBB\AppData\Local\Temp\ C:\Users\BBBB\AppData\Roaming\ C:\Users\BBBB\Desktop\
After successfully deobfuscating the initial script, several sophisticated anti-debugging and anti-tampering mechanisms became clearly visible.
The payload constructs and sends a POST request to a Polygon blockchain RPC endpoint (polygon-rpc.com).
Once SmartLoader resolves the active server, it sends a POST request to /api/<base64_victim_id> on the bare-IP C2. The request body is multipart/form-data... The server responds with JSON...
EtherHiding is an advanced evasion and delivery technique in which attackers leverage blockchain networks as an intermediary infrastructure to host and retrieve command-and-control (C2) information and payload locations.
When unsuspecting users download and run the software from these compromised repositories, they unknowingly retrieve and execute the malicious Lua payload alongside the intended files.
148 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
32 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A multi-file malware loader delivered via cloned GitHub repositories. It uses a renamed LuaJIT interpreter and a text-based payload to evade detection, gathers victim geolocation data, takes screenshots, resolves C2 via the Polygon blockchain using EtherHiding, and downloads a second-stage payload that ultimately delivers an infostealer.
A multi-stage malware loader distributed via trojanized or impersonated GitHub repositories. It performs geolocation reconnaissance, captures screenshots, resolves C2 infrastructure at runtime from the Polygon blockchain using EtherHiding, beacons to C2 with encrypted data, establishes persistence, and downloads/executes second-stage and final payloads including infostealers.
Referenced only as a background example of another AI-themed malware lure.
Related Articles: ... FakeGit campaign uses 7,600 GitHub repos to push SmartLoader malware ...
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.