109 Fake GitHub Repositories Used to Distribute SmartLoader and StealC
Summary
Researchers identified 109 fake GitHub repositories across 103 accounts distributing SmartLoader and StealC. The loader hides execution, collects and exfiltrates host data, resolves C2 through a Polygon contract, and persists with scheduled tasks.
Key points
- The researchers found 109 malicious repositories across 103 accounts, impersonating legitimate projects and steering users to ZIP files embedded in repository trees.
- Extracting and running a batch launcher starts an obfuscated LuaJIT SmartLoader that hides its window, fingerprints the host, captures screenshots, and sends collected data to C2.
- SmartLoader resolves C2 through a Polygon smart contract, allowing the operator to change infrastructure without rebuilding staged samples.
- The loader establishes two scheduled tasks with separate recovery paths: one runs a cached stage, while the other retrieves a fresh stage from GitHub.
- An encrypted file in the campaign's GitHub staging repository decrypted to a packed PE consistent with StealC; SmartLoader can execute PE payloads in memory.
- The campaign had been active for at least seven weeks, with new repositories appearing as of April 12, 2026, according to repository history and file metadata.
- The report recommends verifying project publishers and official releases, and describes monitoring for suspicious GitHub downloads, LuaJIT execution, blockchain RPC queries, bare-IP uploads, and scheduled task creation.
Article Details
- Attack Vectors
- Cloned GitHub repositories impersonated legitimate projects and replaced README content with download links to ZIP files hidden in repository trees.
- Victims who extracted a ZIP and ran its batch launcher started an unsigned LuaJIT interpreter with an obfuscated Lua payload.
- SmartLoader resolved its C2 through a Polygon smart contract, downloaded another Lua stage from GitHub, collected host data and screenshots, and exfiltrated them to bare-IP servers.
- SmartLoader used scheduled tasks for persistence and could decrypt and execute follow-on PE payloads in memory; the staging repository also hosted an encrypted StealC sample.
- Defensive Notes
- Verify repository publishers and prefer official releases over archives buried in repository trees.
- Monitor batch-launched unsigned executables with script arguments, and Lua runtime DLLs loaded from non-standard or user-writable paths.
- Monitor raw GitHub downloads outside established developer baselines, and blockchain RPC traffic from non-browser processes.
- Inspect for the reported smart-contract eth_call request, multipart POSTs to bare-IP /api/ paths, and POST callbacks to bare-IP /task/ paths.
- Alert on scheduled tasks executing from %LOCALAPPDATA%, especially when multiple tasks are created close together.
- Detect archives that bundle LuaJIT or lua51.dll with batch or command scripts; consider application controls for unsigned interpreters and script launchers from user-writable paths.
- Restrict unapproved blockchain RPC endpoints and raw GitHub downloads where operationally appropriate.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 144[.]31[.]57[.]65 | SmartLoader C2 server returned by the Polygon contract. |
| IPV4 | 144[.]31[.]57[.]67 | SmartLoader C2 server returned by the Polygon contract. |
| IPV4 | 213[.]176[.]73[.]149 | StealC C2 server listed in the network indicators. |
| SHA256 | 012b49c7f60bbe0501e61fc62c9b7dd69be9bbf15cb36a840a293b3cb066b865 | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | 09e0f7616dfd2f7eb2876f6ef7331d6dbc78775acd594a94b0397a56717d1fcc | SHA-256 of a Lua runtime DLL distributed with SmartLoader. |
| SHA256 | 0a4bce0f0461335585550598ff33c40a389465f7d0094212bee40b7f525de123 | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | 10cbcb3fb25205a53ea9fe4fad46f45a349f7da8de22dd53a1ce16a920059720 | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | 12a09f9425cd4058956214b237ec82577c7b9ae15f323c28d3b4ad846d0d2f6b | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | 13690a008d375908399e7f0bf8d1b4733498f1145166c7788fb9966c3b551b2f | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | 167b166e26dd44f580a00f2c879089c5362eff5120ac88e0701b11b1eb320ca9 | SHA-256 of a SmartLoader LuaJIT interpreter distributed in the campaign. |
| SHA256 | 1aacc8cb9694293dc152891fc26de64a2061b31a066d297373cdc87da54b6fd8 | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | 212c76daf355ede116eb04d4f9d08a112d07940a14dc248bc568ff1ba0a64e18 | SHA-256 of the encrypted second-stage SmartLoader file message1.txt. |
| SHA256 | 2149a0c948d87f6a80ebb4abddf742c2383f59c7558a313caa0c0fd3bd3cdeef | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | 2273702dfbcfd96a6ed7bdb42ba130291b653869256ec1325bc7fe30e8d9b70a | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | 25aff351f5b4195f33e2fb862f71e3668e699f2311e7844e277b8256a6cb47c0 | SHA-256 of an obfuscated SmartLoader Lua payload. |
| SHA256 | 275275b5099a63724b6f525c1e9de082829e710078e8605c0286998b5a02e75d | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | 2c3c4f1e3401c7baa804c21164b17a2ab50b3462ab09fcdccec35c8faa8e17fb | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | 2d72abb33b8428a3a73fb64a03e6ac84595c4b1636f190f2936fadec3c8792f6 | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | 3217ae928395e00d873cccdf2adfa7828fe319fc84501453e702af91a0af2596 | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | 3299b85734e03cbb767d10f89384f666c35d6863198a7c6c0004ef19fcc76bc4 | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | 3595a6b226ce4daa0a28edea152b3a887c01f6323db1d082f6568c995cdefb55 | SHA-256 of a SmartLoader LuaJIT interpreter distributed in the campaign. |
| SHA256 | 3658fc38c10867e30e3c5c98a7a392e452a4ba497c8a674ff26554bc09f032b0 | SHA-256 of a SmartLoader launcher script. |
| SHA256 | 3989cdf958d258244f3a72bac594214112ffe1008d4d81233a5911482dd302ca | SHA-256 of an obfuscated SmartLoader Lua payload. |
| SHA256 | 440ceb0dc5911faca54ed9a4dd186dad3d006ae4f52d0bb7d1e4b4edd8c3693a | SHA-256 of a Lua runtime DLL distributed with SmartLoader. |
| SHA256 | 44d5de84ee0c31517d114640ba9b9b307ea9e1ec4e591de42cbb4d07ceb5e6c3 | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | 4b3231da6ba13aa1e1eb8dd371e287bc18505273bca5bda80065c60b024549b8 | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | 54bbd79ed1ee26d3e7aa079963ba26c36aa683c01cc8b05b6d255da8634df006 | SHA-256 of an obfuscated SmartLoader Lua payload. |
| SHA256 | 572acf0d7a3801b9bc41f626bac781d75ea1f99770b176079ae5f9a347c09b78 | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | 58b98acb7dc26d8130c20b38ad040e5e7042eac38f12205248595697143c4297 | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | 592ec6f529721acbe07100c5386c58ca20fddfee7ac90280943fc2a61661e2be | SHA-256 of a SmartLoader launcher script. |
| SHA256 | 59c2115caf3104184de6cbc64c4029886b7302e1fa58acc910a2c567222e8616 | SHA-256 of an obfuscated SmartLoader Lua payload. |
| SHA256 | 5b09803d2acbec734d9c88496f9590bb7cbaf5392607ef0f20f79fe177f7fd83 | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | 6b518855404b7281246aab93a46288b25f0cb0f09cdeb820e677ef615bf3fda4 | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | 768c28bff5e2ccd991a4a5cbfe3331015e3262cbc007829631483b46aa582cbc | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | 76afe60e675e68906a2de61d45c46aa6502fe7f9c298260c226a4382744f4212 | SHA-256 of an obfuscated SmartLoader Lua payload. |
| SHA256 | 7e107cc2db66be4c9a90c2ef81f21ae2893962e1040531dff0305d9283f27387 | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | 7e8bd9ba64fcbd1cb753baa2f7bc8d5d7f3e91552bcdc9ec1ec04edd4916ff33 | SHA-256 of a SmartLoader launcher script. |
| SHA256 | 830ec7352972fd1eb24fcaf72349ef9a27dd9f26f24552d6b68b87ffeada1212 | SHA-256 of an obfuscated SmartLoader Lua payload. |
| SHA256 | 87de3e5a8ef669589c421220cd392ae8027a8f8d3cd97d35ac339f87dcff12c8 | SHA-256 of the decrypted packed StealC binary. |
| SHA256 | 8b42ca9d05badf0e7327d816a56e5516431ae34627da68e12ae9347f365b2668 | SHA-256 of a SmartLoader LuaJIT interpreter distributed in the campaign. |
| SHA256 | 8cede35b80b1deaf732c2b178d908f91b3e7a0c114d06dfae9075b8a9bf78b8f | SHA-256 of an obfuscated SmartLoader Lua payload. |
| SHA256 | 998e14a100d1f541f9fd59f4e58dd86e76fe7a105b02646d3487f18583d46c42 | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | 9de5dc4192a9dea43d9ff6289bb276bb3f2c244c15821b6d31fab90258b23149 | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | 9f6368bccedd005075fe991719719b0df5af22df697cab76aa6b4392d38394b1 | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | a50c4c26597cb4dc3ce340e1de0ec929b4a7ab0954a6ba214a32f158f01d6a8a | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | a6fce76371d8b950b22bbea5a94d5688c19368979d06b2ef3c41f18ce6ada4c3 | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | a90898926236de8b574b50ef8c6c0411b193383d6db2214d73ead27c65867fd5 | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | a91b3308a7e9aa9fa660c72d27f226d8f50bfac2629f79a828fbecff323c0fe0 | SHA-256 of a SmartLoader launcher script. |
| SHA256 | a93ac4fb3f9dadc22f7b7f1877bc99b84a77fe3bbe560bdd20bbd7c4b6f9c1d6 | SHA-256 of an obfuscated SmartLoader Lua payload. |
| SHA256 | af6f59bd3caee5daa2d6765dd8c1bc167060a9681617ee1e2aff32f1eda3477c | SHA-256 of a SmartLoader launcher script. |
| SHA256 | b04db6cae604d2ab1542e3c0cf1a4a3bb8d76562556f7275efe25bb90fc1da19 | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | b0f0b6e38f77c518ebfaf691d729636d82cc59dc2a329d7454e11f74a2cb2d3f | SHA-256 of a SmartLoader launcher script. |
| SHA256 | b599a00d1226f6e0d433bf9be89958d6d4600a365c8e16bd86b4603e2552bf37 | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | bbd438d3d7a59152f1dd5e45bb8d22ee1c07f95cfe42cebbe756aaf4feadc875 | SHA-256 of a SmartLoader LuaJIT interpreter distributed in the campaign. |
| SHA256 | bc95563880f17f4c3fc0fd8d3f7abc37b14ffb3daa627f92d5bd0b4f457d54e2 | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | bff0904456e3151221d29ed1d7c88fc31587efbdfb28817cdcb7ec7f20cade21 | SHA-256 of a SmartLoader LuaJIT interpreter distributed in the campaign. |
| SHA256 | c324560d4310849fd6b86e126514b20512905eee7ee94a2152f4314bb4055649 | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | c3b56d68c80c4a6a9879c45a7761a538e3546644623af1ee469d3b70130fa0cd | SHA-256 of a SmartLoader launcher script. |
| SHA256 | c7b71a992c6ca1467164b643136d986c0eec28548f30533456a3ea0f442c85a8 | SHA-256 of an obfuscated SmartLoader Lua payload. |
| SHA256 | cd4d2b6dc9c764c3f2b2b003bce035053a8ce81420c7ea886c76611219cae4ae | SHA-256 of a SmartLoader launcher script. |
| SHA256 | ce1e33483d353200a266b3bc383ccf500e5a760c6dcd8218747260f5bbe39509 | SHA-256 of a SmartLoader launcher script. |
| SHA256 | d067cacea4ec623dc715c27ff7568d14988af0be1f3db32d332f27744114f9ba | SHA-256 of an obfuscated SmartLoader Lua payload. |
| SHA256 | d142be1fc9a7eec7ec26aeea75e5f7a175c4ab9b2ee36b958280873bc3861b2e | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | d1557bc3f5d8542f9b7f8e80b02283397d2e437386a6662251c4fc7342167cda | SHA-256 of a SmartLoader LuaJIT interpreter distributed in the campaign. |
| SHA256 | d56213d08fb10c880f17e1a262bf1176cf234d1fc591188171e7be9cd856eb12 | SHA-256 of a SmartLoader LuaJIT interpreter distributed in the campaign. |
| SHA256 | d8469b109bb22ad367c19971e1065074527af144d4c1e7d7a4cfb0f2d6e12767 | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | d92ac938494c2c74c73f3ca28c5c7148d0a03024b46630192a9348259b7b3665 | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | e12e7d4d7c5ccf825c9c0ba3af32a9d575d1624ad6e3998e7a71c3e0939c0d61 | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | e1e6e28bc665b242fd4b496caf2542042d5720e87ea74551735664c202c486c7 | SHA-256 of a SmartLoader launcher script. |
| SHA256 | e450152d8dd9f7d2d92dbd53461a38ee8f154b69b2558ed43b5d3f603a43240a | SHA-256 of an obfuscated SmartLoader Lua payload. |
| SHA256 | e69873a3ef03b289aba8a0ec7130247dc5f2a3ce8c3b647b44518a899f39f789 | SHA-256 of a SmartLoader LuaJIT interpreter distributed in the campaign. |
| SHA256 | ebe63bd7715e7b2ff0b25c9bb6540a904f7195fb9fb2d405bd0cb5c0c4d34476 | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | f3e34c9e36f3be065d80d456281d31dd1cc85eb4980db7fa8c1b0eb6f29c25d8 | SHA-256 of a SmartLoader LuaJIT interpreter distributed in the campaign. |
| SHA256 | f5bdf3d6c1376476b0d9eb0e74aa5aa8ccc7378068531c8346d76fbef04c6a6e | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | f6d10e879324c36914002ebd989e1a6fdc50e29257078a95e975f18b42f69836 | SHA-256 of a ZIP archive identified as part of the malicious repository campaign. |
| SHA256 | f9436ccb986760ca379d6cd2f00726e032a1d9c250a9bd261d40d98b914e7ef9 | SHA-256 of an obfuscated SmartLoader Lua payload. |
| SHA256 | fad3d429172932b72e50f52af169a80439464e3538d97810509090e2e6cdf32a | SHA-256 of a SmartLoader LuaJIT interpreter distributed in the campaign. |
| URL | hxxps[:]//github[.]com/2aryanZ/paper-submission-check | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/Abisheak250402/cloakbrowser-human | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/abuferas1262/yandex-speedtest-cli | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/AdebSamra/Delta-Clopix-Ultra | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/AdebSamra/marketmuse-premium-access-hub | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/Aditya923-c/xpoz-agent-skills | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/AlexSilgidzhiyan/agent-commerce | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/Ali-Shady/claude-agent-desktop | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/alvfpinedo/go-prometheus-exporter | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/Always15dppk/register | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/amosshadowy76/ai-product-skills | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/anubhavsingh-0218/uncodixify-skill | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/Arlinablind800/qclaw-wechat-client | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/arnautoff1/pump-fun-dashboard | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/arnautoff1/smart-money-miner | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/ashiskumarnanda/symphony-ts | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/Bhin4787/AI-Powered-Ticket-Routing-SLA-Breach-Prediction-in-JIRA | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/Casheu1/perplexity-2api-python | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/Cherishpolyploid691/One-Player | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/Cobras1934/task-calendar-dashboard | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/CobraZero969/EU-Gov-Tracker-Blocklist-by-madnesscc | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/cristiancctlv/recaptcha-botguard | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/CuddlyPaws22/codeclaw | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/DarkSliceYT/ai-infra-index | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/DIMANANDEZ/refrag | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/ejfhgo/hacker-Toolkit | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/eltayep2/hoshan-vehicles | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/eltayep2/india-district-nightlights-viirs | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/fajarsm14/epic-games | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/FILDA007/TokenStream | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/freefire2chyko-a11y/openclaw-autotrader | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/gage6903/son-of-claude | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/GamerX3560/Aria-V-7[.]1 | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/GH8ST007/llms_with_google_cloud | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/h4vzz/awesome-ai-agent-skills | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/halim2023/Ninja-Ripper-2[.]13-Full-Download | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/hama1981/ROBLOX-MACRO-V3[.]0[.]0 | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/haren2312/medusa-mobile-react-native | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/hayate001/GliderUI | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/hayate001/Zygisk-Il2CppDumper | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/Hosk9612/venutian-antfarm | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/IvannGonzzalez/hve-core | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/Jacksonsmg/SoftwareTesting-Cunit | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/jakariyaox-dot/mango-waf | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/jayed50/cpp-dumper | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/jessevanwyk1/claude-scholar | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/Jonaskouame/Phone-Number-Tracker | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/JoOdSy/mini-apps | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/KemalFasa/discord-adapter-meme | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/Ksalazar29/deepseek-claw | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/linhkat3057/Valthrun | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/Loune3213/Wazuh-Openclaw-Autopilot | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/Lyrothanak20/Impacket_Reference | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/marciunyielding712/openage | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/MichaelQDLe/CodeHive | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/Milan-sisodia-27/idl-pu3 | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/minullaksen/Amazon_Sales_Product_-_Revenue_Analysis_Excel | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/mohadesehfllh/gatsby-ecommerce-theme | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/mohadesehfllh/whispr | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/mohamedfaro7/Chuks-YT-Live_AI | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/MohamedSamiHdj/realtime-data-pipeline | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/MPB0828/Greenhouse-Gas-Emissions-Forecasting-with-ARIMA-LSTM | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/mreshuu/STForensicMacOS | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/mrizky214/task-runner-1771921051-1 | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/MrKillerq/Mini-o3 | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/nonunion-loasa895/codapter | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/okoid721/chloroDAG | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/oliverkanda254/medusa-mobile-react-native | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/omkargundle/claude-usage-bar | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/pandu1992/agent-workspace | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/Pataterustiche/tonconnect | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/phongdshh-debug/Ghost-MSG | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/Pr-E/openclaw-master-skills | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/Ragulrajtcestd/LSTM-Optuna | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/rakibul3790/mdexplore | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/renny2020/Open-UI | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/rushikeshjaware/DiffusionDriveV2 | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/sabalearning01/bread-run-simulator-toolkit | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/sabalearning01/OpenClaw-RL | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/Sawyer60/Dataset_HealthHub | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/Seragatia/DocGenie | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/Shavan889/minisforum-ms-s1-max-bios | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/shmilymaria/VesperAIApp | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/Shonpersus/founders-kit | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/shripadk1999/EVOKORE-MCP | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/sidiishan/soul[.]py | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/silent-whisper/Hades-Stealer | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/somya-droid/Pirate-LLM-Server | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/Sriv4/insta-hack-termux | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/stcitlab1/PyrsistenceSniper/ | Malicious GitHub repository impersonating a legitimate project and distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/syedabdullahuddin/n8n-workflow-sdk-mcp | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/TalangoJames/fractals | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/Tawhidhere/OneRec-Think | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/therajeshpatil/home-assistant-global-health-score | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/Tod-weenieroast366/coding-plan-mask | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/twinklew9/notes2latex | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/usernamedoxelghk/WindsurfSwitch | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/Valentin6595/WhatDreamsCost-ComfyUI | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/VantageSolutions/ShadowTool | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/vickykumar11062/Replication-package-for-gender-and-regional-differences-in-scientific-mobility-and-immobility | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/viktor820/AudioAuditor | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/virginiadiom2000-ai/osv-ui | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/vlsienthusiast00x/Spodrue | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/wanderconnect01/ika-network-skill | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/whydixit/cursor-starter | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/WILLIAM86-CAPTAIN/gooey-search-tabs | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/wtfhanin/Enhance-Prompt | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/Xhtira20/scraped | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//github[.]com/YahiaGrdh/vibe-agents | Malicious GitHub repository distributing the campaign ZIP. |
| URL | hxxps[:]//raw[.]githubusercontent[.]com/deepanshugoel99/long/refs/heads/main/long/long/message1[.]txt | Attacker-hosted encrypted second-stage SmartLoader payload retrieved by the malware. |
| URL | hxxps[:]//raw[.]githubusercontent[.]com/deepanshugoel99/long/refs/heads/main/long/long/message2[.]txt | Attacker-hosted encrypted StealC payload fetched during the observed infection chain. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationSmartLoader's Lua payload was Prometheus-obfuscated, with encoded strings and VM-style control flow.T1036 · MasqueradingScheduled-task names such as AudioManager_ODM3 and OfficeClickToRunTask_7d7757 were chosen to resemble legitimate software activity.T1041 · Exfiltration Over C2 ChannelSmartLoader sent collected host metadata and screenshots to its C2 in multipart POST requests.T1053.005 · Scheduled TaskSmartLoader established persistence with two daily Windows scheduled tasks using separate recovery paths.T1059.003 · Windows Command ShellA batch or command launcher used the Windows start command to execute the LuaJIT interpreter with a script argument.T1071.001 · Web ProtocolsSmartLoader communicated with its C2 and staged content over HTTP, including POST requests to bare-IP servers.T1082 · System Information DiscoverySmartLoader fingerprinted the infected host and included host details in its C2 submissions.T1105 · Ingress Tool TransferSmartLoader downloaded a second Lua stage and encrypted payloads from GitHub.T1113 · Screen CaptureSmartLoader captured screenshots through the Windows GDI pipeline and exfiltrated them.T1204.002 · Malicious FileVictims were lured into extracting a repository ZIP and launching its bundled malicious executable or launcher.T1620 · Reflective Code LoadingSmartLoader's PE parsing and executable-memory/thread-creation primitives support reflective loading of PE payloads, including the StealC sample.T1622 · Debugger EvasionSmartLoader performed an anti-debug check using native shellcode copied into executable memory.
Malware
SmartLoaderWe uncovered a malware distribution campaign built around fake GitHub SmartLoader StealC staging, where cloned open source repositories are used to deliver a LuaJIT-based loader and a follow-on stealer.StealCWe uncovered a malware distribution campaign built around fake GitHub SmartLoader StealC staging, where cloned open source repositories are used to deliver a LuaJIT-based loader and a follow-on stealer.
Products
GitHubWe uncovered a malware distribution campaign built around fake GitHub SmartLoader StealC staging, where cloned open source repositories are used to deliver a LuaJIT-based loader and a follow-on stealer.LuaJITWe uncovered a malware distribution campaign built around fake GitHub SmartLoader StealC staging, where cloned open source repositories are used to deliver a LuaJIT-based loader and a follow-on stealer.PolygonSmartLoader resolves its active C2 through a Polygon smart contract, allowing the operator to rotate infrastructure without rebuilding the loader or updating every staged sample.