Netskope Details SmartLoader Infostealer Campaign Using Fake AI Repositories
Summary
Netskope analyzed a campaign delivering infostealers through ClickFix and trojanized GitHub repositories impersonating AI and developer resources. Its two-stage SmartLoader chain uses EtherHiding on Polygon to resolve C2 at runtime.
Key points
- The campaign targets developers and AI users with ClickFix lures and cloned GitHub repositories impersonating resources such as Claude, ComfyUI, Python guides, and Rust frameworks.
- The first-stage archive combines a LuaJIT interpreter, DLL, batch script, and obfuscated Lua code in a text file, which executes when launched together.
- Both SmartLoader stages use EtherHiding to retrieve C2 addresses from the same Polygon smart contract, allowing operators to change destinations without modifying the malware.
- Netskope observed Prometheus obfuscation in Stage 1 and indicators consistent with MoonSec V3 in Stage 2.
- The loaders collect geolocation data, capture screenshots, send XOR-encrypted beacons, and use scheduled-task persistence.
- The second stage downloads and executes varied infostealer payloads, including a NodeJS-based strain analyzed by Netskope.
- Observed victims were mainly in North America, Asia, and Southern Europe; financial services, banking, and technology were among the targeted sectors.
Article Details
- Attack Vectors
- ClickFix social engineering and cloned GitHub repositories lured developers and AI users into downloading and running malicious archives.
- The archives used a batch script to launch a LuaJIT interpreter, which executed obfuscated Lua code from a text file.
- A two-stage SmartLoader chain downloaded additional scripts and payloads from attacker-used GitHub repository URLs.
- Both loader stages resolved C2 addresses at runtime through a Polygon smart contract and public RPC providers.
- Defensive Notes
- Assess the archive components together: the article reports that malicious behavior manifested when the interpreter and its accompanying script were launched in the same working environment.
- Review cloned repository installation instructions and download links; the article reports that attackers modified these links to point to payloads.
- The article reports scheduled-task persistence for SmartLoader and XOR-encrypted beacon and C2-response data.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxps[:]//github[.]com/JuliusMAAR/gpt-re/raw/refs/heads/main/re0.log | Specific GitHub-hosted URL identified in an attacker-issued task for downloading a payload. |
| URL | hxxps[:]//github[.]com/JuliusMAAR/gpt-re/raw/refs/heads/main/re1.log | Specific GitHub-hosted URL identified in an attacker-issued task as the download link for the second-stage Lua script. |
| URL | hxxps[:]//github[.]com/yawalinte/80/raw/refs/heads/main/ae.log | Specific GitHub-hosted URL identified in an attacker-issued task as the download link for the second-stage Lua script. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe Lua stages were obfuscated with Prometheus and, for Stage 2, reportedly consistent with MoonSec V3.T1027.016 · Junk Code InsertionA Stage 2 task used a pump setting with size 700 to alter the payload size.T1041 · Exfiltration Over C2 ChannelThe loader sent a screenshot and victim beacon data to the resolved C2 address in an HTTP POST.T1053.005 · Scheduled TaskThe article reports that SmartLoader established persistence using a scheduled task.T1059.003 · Windows Command ShellApplication.bat was used to launch the LuaJIT interpreter and its script.T1059.010 · AutoHotKey & AutoITThe LuaJIT interpreter executed the obfuscated Lua payloads in gc.txt and dist.lua.T1071.001 · Web ProtocolsThe loader sent an HTTP POST beacon to the resolved C2 address and received task and loader configuration data.T1082 · System Information DiscoverySmartLoader collected the victim's OS version along with IP, country, city, time zone, and ISP information.T1105 · Ingress Tool TransferSmartLoader downloaded the second-stage Lua script and supporting interpreter components from GitHub repository URLs.T1106 · Native APIThe Lua code used Windows APIs through LuaJIT FFI, including GetSystemMetrics, CreateDIBSection, BitBlt, and CreateProcessW.T1113 · Screen CaptureSmartLoader captured a screenshot using GDI APIs, including BitBlt.T1204.002 · Malicious FileThe delivery chain relied on victims running the downloaded archive's batch script, which launched compiler.exe with gc.txt.T1566.002 · Spearphishing LinkClickFix lures and links on impersonated GitHub repositories led victims to the malicious downloads.T1573.001 · Symmetric CryptographyThe loader used an XOR key to encrypt beacon data and decrypt the C2 response.
Malware
Products
Claude#NetskopeThreatLabsComfyUI#NetskopeThreatLabsGitHubNetskope Threat Labs reported a NodeJS-based MaaS infostealer campaign delivered through ClickFix and trojanized GitHub repositories that impersonated AI and developer resources.Microsoft WindowsAttackers delivered a Windows-based MaaS infostealer through ClickFix social engineering and cloned GitHub repositories.PolygonThe operation used a multi-stage SmartLoader chain with EtherHiding on the Polygon blockchain to resolve C2 at runtime and targeted developers across North America, Asia, and Southern Europe.
Tools
Industries
BankingVictims were mainly in North America, Asia, and Southern Europe, with financial services, banking, and technology among the most targeted sectors.Financial ServicesVictims were mainly in North America, Asia, and Southern Europe, with financial services, banking, and technology among the most targeted sectors.TechnologyVictims were mainly in North America, Asia, and Southern Europe, with financial services, banking, and technology among the most targeted sectors.