Loading story…
Attackers are using cloned GitHub repositories that impersonate AI and developer tools to infect users with a multi-stage SmartLoader chain that ends in infostealer deployment, according to reporting from Netskope Threat Labs and related indicator data. The campaign targets AI users and developers, with observed victim concentration in North America, Asia, and Southern Europe, particularly across financial services, banking, and technology organizations. Netskope said the final payload includes a previously reported NodeJS-based Malware-as-a-Service infostealer, turning developer interest in AI tooling into a potential enterprise initial-access vector.
The infection chain relies on Windows-hosted Lua components packaged in ZIP archives and staged through files including lua51.dll, a renamed interpreter such as compiler.exe, Application.bat, obfuscated Lua payloads such as dist.lua, and follow-on executables including 7d7752.exe. Both SmartLoader stages reportedly retrieve command-and-control data dynamically from a Polygon blockchain smart contract using EtherHiding, with supporting indicators showing Polygon RPC endpoints, eth_call activity, an Ethereum-style wallet address, and GitHub-hosted files tied to accounts including yawalinte and JuliusMAAR. Netskope also found signs of Prometheus obfuscation in the first-stage Lua payload and MoonSec V3-style obfuscation in the second stage, indicating a resilient loader design that lets operators rotate C2 infrastructure without changing malware code.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Netskope identified the GitHub account JuliusMAAR as another GitHub account serving identical payloads in the same campaign. The account was created on July 26, 2026.
Netskope identified the GitHub account yawalinte as serving payloads used in the campaign. The account was created on July 21, 2026.
Netskope Threat Labs reported an ongoing campaign targeting AI users and developers through cloned GitHub repositories impersonating legitimate AI and developer resources. The campaign shifted delivery from earlier ClickFix-based lures to malicious payloads hosted in impersonated repositories and used a multi-stage SmartLoader chain ending in infostealer deployment.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcecryptika.com
Open sourcenetskope.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a large-scale GitHub malware distribution campaign that has operated since March 2025, using repositories masquerading as cracked browser extensions, gaming cheats, developer tools, and, more recently, fake AI skills and MCP servers. The activity has been tied to a Vietnamese-speaking operator and spans more than 47 GitHub accounts and 600 malicious ZIP archives, with some accounts believed to have been compromised rather than created solely for abuse. The campaign’s social-engineering lures target both general users and developers seeking unofficial software, automation tools, or AI-related components. The repositories deliver a multi-stage **LuaJIT** loader chain that ultimately installs the **StealC** information stealer. Payloads are fetched from GitHub “dead drop” repositories, then decrypted through layered obfuscation including hex, XOR, `base64url`, and **AES-ECB** before process hollowing is used for injection. Researchers said the malware also resolves command-and-control infrastructure through **Polygon Mainnet** smart contracts, allowing operators to rotate C2 URLs or IPs without changing deployed binaries; telemetry linked the activity to detections such as BitDefender `Gen:Heur.FakeGit.1` and ESET’s `Lua/Agent` family, while infrastructure usage heavily overlapped with bulletproof hosting providers including **ASN 207957 (Serv.host Group Ltd)**.
Jul 22, 2026
Multiple reports describe threat actors abusing *AI-adjacent* and open-source distribution channels to deliver malware or manipulate automated agents. Straiker STAR Labs reported a **SmartLoader** campaign that trojanized a legitimate-looking **Model Context Protocol (MCP)** server tied to *Oura* by cloning the project, fabricating GitHub credibility (fake forks/contributors), and getting the poisoned server listed in MCP registries; the payload ultimately deployed **StealC** to steal credentials and crypto-wallet data. Separately, researchers observed attackers using trusted platforms and SaaS reputations for delivery and monetization: a fake Android “antivirus” (*TrustBastion*) was hosted via **Hugging Face** repositories to distribute banking/credential-stealing malware, and Trend Micro documented spam/phishing that abused **Atlassian Jira Cloud** email reputation and **Keitaro TDS** redirects to funnel targets (including government/corporate users across multiple language groups) into investment scams and online casinos. In parallel, research highlights emerging risks where **AI agents and AI-enabled workflows become the target or the transport layer**. Check Point demonstrated “**AI as a proxy**,” where web-enabled assistants (e.g., *Grok*, *Microsoft Copilot*) can be coerced into acting as covert **C2 relays**, blending attacker traffic into commonly allowed enterprise destinations, and outlined a trajectory toward prompt-driven, adaptive malware behavior. OpenClaw featured in two distinct security developments: an OpenClaw advisory described a **log-poisoning / indirect prompt-injection** weakness (unsanitized WebSocket headers written to logs that may later be ingested as trusted context), while Hudson Rock reported an infostealer incident that exfiltrated sensitive **OpenClaw configuration artifacts** (e.g., `openclaw.json` tokens, `device.json` keys, and “memory/soul” files), signaling that infostealer operators are beginning to harvest AI-agent identities and automation secrets in addition to browser credentials.
Jun 29, 2026
Threat researchers uncovered multiple malware campaigns abusing trusted developer and AI distribution platforms to spread **Rust-based infostealers** through fake or typosquatted repositories. HiddenLayer found that a malicious Hugging Face project, `Open-OSS/privacy-filter`, impersonated OpenAI’s legitimate Privacy Filter repository, briefly became the platform’s top trending project, and was downloaded about **244,000** times before removal. The repository’s `loader.py` fetched a multi-stage payload ending in the `sefirah` infostealer, which harvested browser data, Discord tokens, cryptocurrency wallet data, SSH/FTP/VPN credentials, local files, system details, and screenshots, then exfiltrated the data to `recargapopular[.]com`. Researchers also linked the activity to overlaps with an npm typosquatting campaign associated with the **WinOS 4.0** implant. In a parallel campaign, Netskope reported that attackers impersonated the OpenClaw project with a fake installer site and a typosquatted GitHub organization to deliver a previously undocumented Rust dropper called **Hologram** and a modular implant framework. The malware targeted credentials from more than **250** cryptocurrency wallet, password manager, and 2FA browser extensions, while using anti-sandbox checks, in-memory .NET execution, reflective PE loading, persistence via `Userinit`, COM hijacking, and scheduled tasks, plus direct NT syscall thread injection. Operators staged and relayed infrastructure through legitimate services including **Azure DevOps, Telegram, Hookdeck, snippet.host, and Pastebin**; Netskope said the operation marked the first documented malware abuse of Hookdeck as a C2 relay and later evolved into a third wave, **Pathfinder**, that added confirmed Vidar infostealer delivery.
Jun 29, 2026