Fake AI and Developer GitHub Repositories Deliver Multi-Stage Infostealer

Aug 3, 2026 · Original article ↗

Summary

Netskope researchers detail a campaign using cloned AI and developer repositories to deliver an infostealer through two SmartLoader stages, which use Polygon smart contracts to resolve C2 addresses at runtime.

Key points

Attackers cloned popular AI and developer repositories and altered download links or added malicious files to trick users into running the infostealer.
The first SmartLoader stage arrives in a ZIP with LuaJIT components and an obfuscated Lua script disguised as a text file.
Both loader stages use EtherHiding to retrieve C2 addresses from the same Polygon smart contract, allowing operators to change destinations without modifying the malware.
The first stage collects victim geolocation and a screenshot, sends an encrypted beacon, and establishes persistence before downloading the second stage.
The second stage uses similar C2 and reconnaissance techniques and retrieves varied final infostealers, including a NodeJS-based strain.
The campaign targeted AI users and developers; the analyzed GitHub accounts serving payloads were reported for takedown.

Article Details

Attack Vectors: Attackers cloned and impersonated well-known GitHub repositories containing AI resources and developer tools, then modified installation URLs or added payloads in subdirectories to lure victims into downloading and executing infostealers.
The campaign used ClickFix social engineering and multi-stage SmartLoader delivery. Stage 1 arrived in a ZIP archive containing a malicious Lua script obfuscated with Prometheus; Stage 2 used a Lua script likely obfuscated with MoonSec V3.
A batch script launched a renamed LuaJIT interpreter with malicious Lua code stored in a text file, which assembled and executed its payload at runtime.
SmartLoader resolved C2 addresses from a Polygon smart contract using EtherHiding and public Polygon RPC providers, then sent victim information and screenshots to the resolved C2.
The loaders downloaded and executed additional payloads from GitHub-hosted repository resources and used scheduled-task persistence.
Defensive Notes: Do not treat text files or individual components as benign solely because they appear non-executable or produce no malicious behavior in isolation; the article reports malicious activity when modular dependencies are launched together.
Monitor for trojanized or impersonated repositories and modified installation links, especially resources aimed at AI users and developers.
Monitor LuaJIT interpreter execution with accompanying scripts, suspicious batch-script launches, scheduled-task creation, screenshot capture, and outbound requests to Polygon RPC providers.
The article reports that the two GitHub accounts serving identical payloads, yawalinte and JuliusMAAR, were reported for takedown.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`polygon-mainnet[.]gateway[.]tatum[.]io`	Additional Polygon RPC provider used by Stage 2 for EtherHiding C2 resolution.
DOMAIN	`polygon-public[.]nodies[.]app`	Additional Polygon RPC provider used by Stage 2 for EtherHiding C2 resolution.
DOMAIN	`polygon[.]drpc[.]org`	Public Polygon RPC provider queried by SmartLoader to resolve the attacker's C2 address.
DOMAIN	`polygon[.]publicnode[.]com`	Public Polygon RPC provider queried by SmartLoader to resolve the attacker's C2 address.
DOMAIN	`rpc-mainnet[.]matic[.]quiknode[.]pro`	Public Polygon RPC provider queried by SmartLoader to resolve the attacker's C2 address.
URL	`hxxps[:]//github[.]com/JuliusMAAR/gpt-re/raw/refs/heads/main/re0[.]log`	GitHub-hosted task link used to retrieve and execute a payload.
URL	`hxxps[:]//github[.]com/JuliusMAAR/gpt-re/raw/refs/heads/main/re1[.]log`	GitHub-hosted task link used by the loader to download the second-stage Lua script.
URL	`hxxps[:]//github[.]com/yawalinte/80/raw/refs/heads/main/ae[.]log`	GitHub-hosted task link used by SmartLoader to download a second-stage payload.