Loading story…
A sophisticated malvertising campaign is targeting IT professionals in the EU with fake GitHub Desktop installers. The attackers use Google Ads and modified GitHub repository pages to deliver malware that evades analysis and detection. The campaign, active for over six months, aims for credential theft, infostealing, and potential ransomware deployment.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported a **FakeGit** campaign using counterfeit GitHub repositories to trick developers into downloading trojanized tools, with Magento developers among the primary targets. The repositories copied code, commit history, and project structure from legitimate open-source deployment, Docker, and configuration projects so that authentic contributor names appeared alongside the fake repos, increasing credibility. Victims were directed to download ZIP archives that contained a LuaJIT runtime, a batch launcher, and obfuscated Lua payloads that installed Windows malware, including a remote access trojan and keylogger; Sansec also published malicious GitHub accounts, repository names, and SHA1 hashes tied to the operation. A related lure expanded the campaign beyond Magento by impersonating a security automation project named **`n8n-CyberSecurity-Workflows`**, targeting red team, blue team, and AppSec users with GitHub stars, an MIT license, and a README download button. Analysis of the downloaded archive found a Lua-based trojan loader using DLL sideloading through a renamed Lua 5.1 interpreter to execute obfuscated bytecode, with VirusTotal detections labeling the payload as **`trojan.fakegit/runner`**. The malware was also observed contacting a Polygon blockchain RPC endpoint, behavior researchers said aligns with crypto-clipper or wallet-drainer activity, indicating the FakeGit operation is using trusted developer platforms to distribute credential theft and broader financially motivated malware.
Aug 14, 2026
Researchers reported a large-scale GitHub malware distribution campaign that has operated since March 2025, using repositories masquerading as cracked browser extensions, gaming cheats, developer tools, and, more recently, fake AI skills and MCP servers. The activity has been tied to a Vietnamese-speaking operator and spans more than 47 GitHub accounts and 600 malicious ZIP archives, with some accounts believed to have been compromised rather than created solely for abuse. The campaign’s social-engineering lures target both general users and developers seeking unofficial software, automation tools, or AI-related components. The repositories deliver a multi-stage **LuaJIT** loader chain that ultimately installs the **StealC** information stealer. Payloads are fetched from GitHub “dead drop” repositories, then decrypted through layered obfuscation including hex, XOR, `base64url`, and **AES-ECB** before process hollowing is used for injection. Researchers said the malware also resolves command-and-control infrastructure through **Polygon Mainnet** smart contracts, allowing operators to rotate C2 URLs or IPs without changing deployed binaries; telemetry linked the activity to detections such as BitDefender `Gen:Heur.FakeGit.1` and ESET’s `Lua/Agent` family, while infrastructure usage heavily overlapped with bulletproof hosting providers including **ASN 207957 (Serv.host Group Ltd)**.
Jul 22, 2026
An unattributed threat actor has run a large malicious GitHub campaign using at least **292 brand-impersonation repositories and pages** to distribute a **BoryptGrab-lineage infostealer**. The operation used deceptive GitHub profiles and `.github` repositories that mimicked legitimate software companies and trusted security vendors, including a fake **Arctic Wolf** GitHub presence, to make the content appear credible to developers and IT users. The repositories reportedly used marketing-style `README` files to look legitimate while concealing download links that redirected victims to malicious payloads. Researchers said the activity had been active since **26 June 2026**, indicating a broad social-engineering effort that abused GitHub's trust model to lure users seeking software, tools, or vendor resources into downloading credential-stealing malware.
Jul 17, 2026