FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader and StealC
Summary
Researchers say FakeGit used 7,600 GitHub repositories to distribute SmartLoader and StealC, with over 14 million recorded download events. More than 800 repositories targeted AI agents; the download count does not represent infections.
Key points
- Island researchers found more than 7,600 malicious repositories linked to SmartLoader and StealC, with 14,084,688 download events across 335 release assets in 211 repositories; repeated requests and automation were included.
- More than 800 repositories impersonated AI skills or MCP servers, appearing over 600 times in public registries and catalogs.
- The repositories used copied descriptions, fabricated popularity metrics, and convincing README files to direct users to ZIP archives containing Lua payloads.
- According to researchers, SmartLoader establishes persistence through scheduled tasks, retrieves a command-and-control address through a Polygon smart contract, and downloads encrypted stages that deliver StealC.
- In limited controlled tests, AI assistants surfaced malicious repositories; Claude Code cloned repositories and downloaded files but stopped after detecting suspicious indicators, before execution.
- Researchers said FakeGit appears to continue an earlier Lumma Stealer operation attributed to Water Kurita.
Article Details
- Event Type
- Malware-distribution campaign using malicious GitHub repositories and AI-agent baiting
- Impact
- FakeGit used 7,600 malicious GitHub repositories to distribute SmartLoader and StealC. More than 14 million download events were recorded for public release assets, but Island clarified that the figure includes repeated requests and automated activity and should not be interpreted as infections. More than 800 repositories impersonated AI skills or MCP servers, and researchers found over 600 related listings in public AI registries and catalogs. In controlled testing, Claude Code downloaded malicious files but stopped before execution after detecting suspicious indicators.
MITRE ATT&CK
People
Threat Actors
Malware
Lumma StealerResearchers say the operation uses “agentbaiting” to lure AI agents and developers into trusting fake AI tools, while its roots appear tied to an earlier Lumma Stealer campaign linked to Water Kurita.SmartLoaderA large-scale campaign called FakeGit is using 7,600 malicious GitHub repositories to distribute SmartLoader and StealC, with more than 14 million recorded download events across public release assets.StealCA large-scale campaign called FakeGit is using 7,600 malicious GitHub repositories to distribute SmartLoader and StealC, with more than 14 million recorded download events across public release assets.
Products
ChatGPTIn Island’s tests, ChatGPT, Gemini, and Claude surfaced various malicious repositories when prompted with related tasks, and sometimes relayed the installation instructions.ClaudeIn Island’s tests, ChatGPT, Gemini, and Claude surfaced various malicious repositories when prompted with related tasks, and sometimes relayed the installation instructions.Claude CodeIsland researchers told BleepingComputer that in limited, controlled testing, Claude Code cloned malicious repositories and downloaded the malicious files onto the test machine.GeminiIn Island’s tests, ChatGPT, Gemini, and Claude surfaced various malicious repositories when prompted with related tasks, and sometimes relayed the installation instructions.GitHubA large-scale campaign called FakeGit is using 7,600 malicious GitHub repositories to distribute SmartLoader and StealC, with more than 14 million recorded download events across public release assets.