FakeGit Campaign Returns with 17,610 Malicious GitHub Repositories
Summary
Researchers say the FakeGit campaign resumed on October 4, using 17,610 GitHub repositories to distribute SmartLoader, which can deliver other malware. The repositories use README download links to malicious ZIP archives.
Key points
- Apiiro researchers reported that FakeGit resumed activity on October 4 and had 17,610 malicious GitHub repositories.
- The campaign added more than 13,000 repositories in 34 hours, peaking at 2,999 per hour.
- The repositories use convincing README instructions and download buttons linking to ZIP archives containing SmartLoader.
- In sampled commits, 97% changed only the README and 88% linked to a ZIP that installs SmartLoader.
- Researchers identified at least 700 accounts that appear to belong to legitimate developers; most other accounts were described as throwaways.
- Copies of malicious archives remain in forks, older files, release assets, issue attachments, and separate hosting repositories, complicating takedowns.
- Users should verify repository owners and use official registries or vendor repositories for AI skills and MCP servers; suspected SmartLoader execution warrants treating the event as a possible GitHub account compromise.
Article Details
- Event Type
- Renewed malware distribution through malicious GitHub repositories
- Impact
- Apiiro reported 17,610 malicious repositories distributing SmartLoader to deliver StealC, with more than 13,000 repositories updated in 34 hours. Researchers identified at least 700 accounts that appeared to belong to legitimate developers. In Apiiro's sampled commits, 88% linked to ZIP archives that install SmartLoader. Researchers advised treating suspected SmartLoader execution as a potential GitHub account compromise.
MITRE ATT&CK
Malware
SmartLoaderMore than 17,000 fake repositories on GitHub are distributing the SmartLoader malware after the FakeGit campaign reactivated earlier this month to push the StealC infostealer.StealCMore than 17,000 fake repositories on GitHub are distributing the SmartLoader malware after the FakeGit campaign reactivated earlier this month to push the StealC infostealer.