Fake AI and Developer Repositories Deliver Infostealer via SmartLoader
Summary
Netskope details a campaign using cloned AI and developer repositories to deliver infostealers through a two-stage SmartLoader chain, with C2 addresses resolved from the Polygon blockchain.
Key points
- Attackers cloned popular AI and developer repositories and altered files or installation links to trick users into downloading infostealer malware.
- The first-stage ZIP combines a LuaJIT interpreter with an obfuscated Lua script disguised as a text file, which executes when launched with the other components.
- A second SmartLoader stage uses a Lua script obfuscated with MoonSec; samples ultimately delivered several infostealers, including a previously reported NodeJS strain.
- Both loader stages use EtherHiding to retrieve C2 addresses from a Polygon smart contract, allowing operators to change destinations without modifying malware.
- The first loader collects geolocation data, captures a screenshot, and sends it with a victim beacon to its C2 server.
- The campaign targeted developers and AI users; Netskope reported the GitHub accounts serving payloads for takedown.
Article Details
- Attack Vectors
- Cloned or impersonated GitHub repositories host malicious payloads in archives or alter installation links to lure developers and AI users into downloading and executing the infostealer.
- A four-file archive launches obfuscated Lua code through a renamed LuaJIT interpreter; a second SmartLoader stage downloads and executes a further Lua script and final infostealer payload.
- Both SmartLoader stages resolve C2 addresses at runtime through a Polygon smart contract using EtherHiding, then communicate with the resolved server over HTTP.
- The loaders collect victim geolocation information and capture screenshots; the first stage sends a screenshot and encrypted beacon to C2.
- The first-stage loader uses a scheduled task for persistence.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxps[:]//github[.]com/JuliusMAAR/gpt-re/raw/refs/heads/main/re0[.]log | Specific GitHub-hosted payload resource identified in the second-stage task instructions. |
| URL | hxxps[:]//github[.]com/JuliusMAAR/gpt-re/raw/refs/heads/main/re1[.]log | Specific GitHub-hosted Lua script resource identified in the second-stage task instructions. |
| URL | hxxps[:]//github[.]com/yawalinte/80/raw/refs/heads/main/ae[.]log | Specific GitHub-hosted payload resource identified in the SmartLoader task instructions. |
MITRE ATT&CK
T1053.005 · Scheduled TaskSmartLoader establishes persistence using a scheduled task with randomized execution time and task name.T1071.001 · Web ProtocolsThe loader sends an HTTP POST beacon containing a screenshot and encrypted victim data to its resolved C2 server.T1105 · Ingress Tool TransferSmartLoader downloads the second-stage Lua script and associated runtime files from GitHub; the second stage retrieves the final payload.T1106 · Native APIThe first-stage loader calls CreateProcessW to launch the LuaJIT interpreter for the second-stage script.T1113 · Screen CaptureSmartLoader captures a screenshot of the victim's device using Windows GDI APIs.
Malware
Products
ClaudeThe lures include Claude, ComfyUI, AI coding assistants, Python security guides, and Rust frameworks, targeting developers and AI users.ComfyUIThe lures include Claude, ComfyUI, AI coding assistants, Python security guides, and Rust frameworks, targeting developers and AI users.GitHubAs we tracked this infostealer, we uncovered ongoing campaigns in which attackers shifted delivery vectors, cloning and impersonating known GitHub repositories and redirecting download links at their payloads.
Tools
Industries
Bankingin North America, Asia, and Southern Europe, across different segments, with the financial services, banking, and technology sectors leading.Financial Serviceswere mainly in North America, Asia, and Southern Europe, across different segments, with the financial services, banking, and technology sectors leading.TechnologyAsia, and Southern Europe, across different segments, with the financial services, banking, and technology sectors leading.