Loading story…
Researchers reported a large-scale GitHub malware distribution campaign that has operated since March 2025, using repositories masquerading as cracked browser extensions, gaming cheats, developer tools, and, more recently, fake AI skills and MCP servers. The activity has been tied to a Vietnamese-speaking operator and spans more than 47 GitHub accounts and 600 malicious ZIP archives, with some accounts believed to have been compromised rather than created solely for abuse. The campaign’s social-engineering lures target both general users and developers seeking unofficial software, automation tools, or AI-related components.
The repositories deliver a multi-stage LuaJIT loader chain that ultimately installs the StealC information stealer. Payloads are fetched from GitHub “dead drop” repositories, then decrypted through layered obfuscation including hex, XOR, base64url, and AES-ECB before process hollowing is used for injection. Researchers said the malware also resolves command-and-control infrastructure through Polygon Mainnet smart contracts, allowing operators to rotate C2 URLs or IPs without changing deployed binaries; telemetry linked the activity to detections such as BitDefender Gen:Heur.FakeGit.1 and ESET’s Lua/Agent family, while infrastructure usage heavily overlapped with bulletproof hosting providers including ASN 207957 (Serv.host Group Ltd).
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Researchers reported that by July 2026 the FakeGit campaign had grown to about 7,600 malicious GitHub repositories created from roughly 6,600 profiles, with more than 14 million downloads observed across release assets in around 200 repositories. The campaign also evolved to impersonate AI skills and Model Context Protocol servers, a tactic Island described as 'AgentBaiting,' while continuing to deliver a LuaJIT-based loader chain leading to SmartLoader and StealC.
As of March 4, 2026, Derp observed that the large-scale FakeGit campaign had used more than 600 unique malicious ZIP archives across over 47 GitHub accounts, with at least 25 accounts still active. The report also noted some of the accounts appeared to be compromised rather than purpose-built.
Derp reported that a Vietnamese-speaking operator began a GitHub-based malware distribution campaign in March 2025, using repositories impersonating cracked browser extensions, gaming cheats, developer utilities, and similar lures. The campaign delivered a LuaJIT loader chain that ultimately installed the StealC information stealer.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 112 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
15 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcecysecurity.news
Open sourcerhisac.org
Open sourcecybersecuritynews.com
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors abused GitHub to distribute malware by cloning legitimate repositories, impersonating trusted open-source projects, and poisoning search results to steer victims to trojanized downloads. One campaign spoofed the **AIMMY** game-cheat project through a cloned repository and the lookalike site `aimmy.app`, while also exploiting GitHub's issue-draft upload behavior to host malicious files on the original benign repository via direct links that appeared trustworthy. The delivered packages included files such as `Aimmy.bat`, `AimmyLauncher.exe`, `lua51.dll`, and supporting data, with the malware implemented through obfuscated **LuaJIT** code. Follow-on analysis tied similar GitHub repo poisoning activity to **SmartLoader**, which used trojanized `lua51.dll` components and heavily obfuscated Lua payloads to deploy **StealC** infostealer. The malware performed anti-debugging and anti-tamper checks, captured screenshots, verified connectivity and geolocation, and fetched additional payloads from attacker-controlled GitHub repositories. Researchers found it also used the **EtherHiding** technique, querying the Polygon PoS blockchain for dynamically updated command-and-control data, before exfiltrating browser credentials, cookies, cryptocurrency wallet information, and email data to attacker infrastructure including `213.176.72[.]200`.
Aug 15, 2026
Security researchers reported a **FakeGit** campaign using counterfeit GitHub repositories to trick developers into downloading trojanized tools, with Magento developers among the primary targets. The repositories copied code, commit history, and project structure from legitimate open-source deployment, Docker, and configuration projects so that authentic contributor names appeared alongside the fake repos, increasing credibility. Victims were directed to download ZIP archives that contained a LuaJIT runtime, a batch launcher, and obfuscated Lua payloads that installed Windows malware, including a remote access trojan and keylogger; Sansec also published malicious GitHub accounts, repository names, and SHA1 hashes tied to the operation. A related lure expanded the campaign beyond Magento by impersonating a security automation project named **`n8n-CyberSecurity-Workflows`**, targeting red team, blue team, and AppSec users with GitHub stars, an MIT license, and a README download button. Analysis of the downloaded archive found a Lua-based trojan loader using DLL sideloading through a renamed Lua 5.1 interpreter to execute obfuscated bytecode, with VirusTotal detections labeling the payload as **`trojan.fakegit/runner`**. The malware was also observed contacting a Polygon blockchain RPC endpoint, behavior researchers said aligns with crypto-clipper or wallet-drainer activity, indicating the FakeGit operation is using trusted developer platforms to distribute credential theft and broader financially motivated malware.
Aug 14, 2026
Attackers are using cloned GitHub repositories that impersonate AI and developer tools to infect users with a multi-stage **SmartLoader** chain that ends in infostealer deployment, according to reporting from Netskope Threat Labs and related indicator data. The campaign targets AI users and developers, with observed victim concentration in North America, Asia, and Southern Europe, particularly across financial services, banking, and technology organizations. Netskope said the final payload includes a previously reported NodeJS-based Malware-as-a-Service infostealer, turning developer interest in AI tooling into a potential enterprise initial-access vector. The infection chain relies on Windows-hosted Lua components packaged in ZIP archives and staged through files including `lua51.dll`, a renamed interpreter such as `compiler.exe`, `Application.bat`, obfuscated Lua payloads such as `dist.lua`, and follow-on executables including `7d7752.exe`. Both SmartLoader stages reportedly retrieve command-and-control data dynamically from a Polygon blockchain smart contract using **EtherHiding**, with supporting indicators showing Polygon RPC endpoints, `eth_call` activity, an Ethereum-style wallet address, and GitHub-hosted files tied to accounts including `yawalinte` and `JuliusMAAR`. Netskope also found signs of **Prometheus** obfuscation in the first-stage Lua payload and **MoonSec V3**-style obfuscation in the second stage, indicating a resilient loader design that lets operators rotate C2 infrastructure without changing malware code.
Aug 4, 2026