AI developers targeted via trojanized GitHub repositories

1. Executive summary

Netskope Threat Labs reports a financially motivated campaign — tracked under the name "TroysDen's" — that clones popular GitHub repositories for AI tools and developer resources to distribute a Windows-based MaaS infostealer. The delivery mechanism uses trojanized repositories branded as Claude, ComfyUI, AI coding assistants, Python security guides, and Rust frameworks, deploying a multi-stage loader called SmartLoader that resolves its C2 infrastructure via the Polygon blockchain (EtherHiding). EMEA financial services organisations with data-science, ML, or AI-development teams who pull code from GitHub are exposed to credential theft and downstream compromise of build pipelines.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. While the campaign targets developer workstations, the trigger facts here — social-engineering via public repositories and infostealer deployment — do not distinctively invoke any article in the provided regulatory reference beyond what would be true of any security incident.

3. Technical analysis & attack chain

Attribution caveat: No MITRE ATT&CK actor profile is available in the verified reference data for this item. The campaign is attributed by Netskope to a financially motivated group operating a MaaS infostealer. Attribution is unconfirmed beyond Netskope's reporting.

Attack chain (corroborated by Netskope primary source)

1. Initial access — repository cloning: Attackers clone well-known GitHub repositories for AI/developer tooling. The root page appears authentic and the original contributor is listed. Malicious payloads are added to benign-looking subdirectories or installation URLs are modified.
2. Lure — branded tooling: Lures observed include fake tools branded as Claude, ComfyUI, AI coding assistants, Python security guides, and Rust frameworks.
3. Delivery — ZIP archive: The victim downloads and extracts a ZIP archive containing four files: - lua51.dll — legitimate LuaJIT runtime DLL - compiler.exe — renamed LuaJIT interpreter (not a compiler) - Application.bat — batch script launcher - gc.txt — plain text file containing encrypted malicious code
4. Execution — SmartLoader stage 1: Application.bat launches compiler.exe with gc.txt as an argument. The LuaJIT interpreter reads and executes gc.txt. The Prometheus virtual machine reconstructs malicious code from an encrypted string pool. All malicious activity (network requests, file writes, process creation) runs inside the compiler.exe process. A key defense-evasion property: lua51.dll's LuaJIT runtime allows Lua code to call Windows APIs directly by name at runtime, so those calls do not appear in the import table of the executable.
5. Reconnaissance: SmartLoader sends a GET request to ip-api.com to collect victim IP address, country, city, time zone, and ISP — data used by attackers to triage targets.
6. C2 resolution — EtherHiding: Rather than hardcoding a server address, SmartLoader resolves its C2 IP from the Polygon blockchain at runtime by querying a smart contract through public RPC providers.
7. Beacon: SmartLoader takes a screenshot of the victim's desktop. It sends an encrypted beacon containing: loader ID, device identifier, victim's public IP, and OS version — along with the screenshot — to the resolved C2.
8. Stage 2 delivery: The C2 response carries encrypted configuration data and a task list. In observed cases, this instructed SmartLoader to download dist.lua — a second-stage script bundled with its own LuaJIT interpreter and DLL. Static analysis linked stage-2 obfuscation to MoonSec (a different obfuscator from stage 1; no version marker found).
9. Infostealer deployment: The second-stage Lua script ultimately delivers the MaaS infostealer payload.

Defense-evasion properties

• Code stored in a plain text file (gc.txt) rather than a standalone executable; automated scanners and sandboxes checking files individually do not flag any single component.
• Windows API calls made at runtime via LuaJIT, absent from the host executable's import table.
• C2 address stored on-chain; if a server is blocked, attackers update the smart contract value and all infected machines autonomously pick up the new address — no malware update required.

Context from related campaigns (single-sourced; verify before enforcement)

• Arctic Wolf reported 292 impersonated repositories spanning security tooling, fintech, cryptocurrency, developer tools, and gaming (July 2026). It is unclear from the available sources whether this is the same actor or a parallel campaign.
• Island reported ~7,600 malicious GitHub repositories (FakeGit operation), ~800 posing as AI Skills or MCP servers, tied to ~6,600 accounts (peaked April 2026). Relationship to the Netskope-tracked TroysDen's campaign is not confirmed in the provided sources.

4. Mitigation & containment

P1 — Within 24 hours

• Search endpoint telemetry and proxy logs for the distinctive file组合: compiler.exe + gc.txt + Application.bat + lua51.dll appearing in the same directory or ZIP archive.
• Block and quarantine any matched hosts; capture memory and disk forensics.
• Review proxy/DNS logs for outbound GET requests to ip-api.com from developer workstations that are not part of normal business workflow.
• Search egress logs for connections to known Polygon RPC endpoints from developer machines (this is unusual for non-blockchain-development roles).

P2 — Within 72 hours

• Audit all GitHub repositories cloned or forked by AI/ML/data-science teams in the past 90 days. Verify upstream provenance against the original author's canonical repository. Pay particular attention to repositories claiming to be Claude, ComfyUI, AI coding assistants, Python security guides, or Rust frameworks.
• Implement allowlisting for GitHub repositories used in CI/CD pipelines; block ad-hoc clones from unverified forks.
• Deploy EDR rules targeting the SmartLoader execution pattern: batch script launching a renamed LuaJIT interpreter with a .txt argument (see §6).
• Review browser download history and developer workstation disk images for dist.lua or additional LuaJIT bundles indicating stage-2 delivery.

P3 — Within 7 days

• Establish a process for verifying GitHub repository authenticity before cloning: confirm the original author account, check commit history for anomalous additions, and diff against the upstream canonical repo.
• Restrict developer workstation egress to blockchain RPC providers unless explicitly required for business purposes.
• Educate AI/ML development teams on the trojanized-repository threat pattern and the ClickFix social-engineering vector.
• If stage-2 infostealer delivery is confirmed on any host, assume credential compromise: rotate all credentials, API keys, tokens, and session cookies accessible from the affected machine, including cloud provider credentials, GitHub PATs, and internal service credentials.

5. Indicators of compromise

Note: ip-api[.]com is a legitimate IP geolocation service abused for reconnaissance. Blocking it may impact legitimate business use; apply to developer workstations only if appropriate.

filename  lua51.dll
filename  compiler.exe
filename  Application.bat
filename  gc.txt
filename  dist.lua
domain  ip-api[.]com

Behavioural indicators

6. Detection

rule SmartLoader_TroysDen_Stage1 {
  meta:
    author = "Adverse Trace"
    date = "2026-08-04"
    reference = "https://www.helpnetsecurity.com/2026/08/04/developers-github-fake-ai-tools-infostealer/"
    description = "Detects SmartLoader components associated with TroysDen's GitHub campaign"
  strings:
    $lua51 = "lua51.dll" ascii nocase
    $compiler = "compiler.exe" ascii nocase
    $appbat = "Application.bat" ascii nocase
    $gctxt = "gc.txt" ascii nocase
    $distlua = "dist.lua" ascii nocase
    $prometheus = "Prometheus" ascii nocase
  condition:
    3 of them
}

title: SmartLoader Execution - Batch Script Launching LuaJIT Interpreter with Text File Argument
id: AT-2026-08-04-460-001
status: experimental
description: Detects Application.bat launching compiler.exe (renamed LuaJIT) with gc.txt as argument, consistent with SmartLoader stage-1 execution
author: Adverse Trace
date: 2026/08/04
references:

  - https://www.helpnetsecurity.com/2026/08/04/developers-github-fake-ai-tools-infostealer/
logsource:
  product: windows
  category: process_creation
detection:
  selection_batch_launch:
    Image|endswith: '\cmd.exe'
    CommandLine|contains|all:

      - 'Application.bat'
  selection_interpreter_arg:
    Image|endswith: '\compiler.exe'
    CommandLine|contains:

      - 'gc.txt'
  condition: selection_batch_launch or selection_interpreter_arg
falsepositives:

  - Legitimate use of LuaJIT interpreters renamed as compiler.exe (unlikely in enterprise environments)
level: high

title: SmartLoader C2 Reconnaissance - GET Request to ip-api.com
id: AT-2026-08-04-460-002
status: experimental
description: Detects outbound GET request to ip-api.com from developer workstations, consistent with SmartLoader reconnaissance behaviour
author: Adverse Trace
date: 2026/08/04
references:

  - https://www.helpnetsecurity.com/2026/08/04/developers-github-fake-ai-tools-infostealer/
logsource:
  product: proxy
detection:
  selection:
    DestinationHostname|contains: 'ip-api.com'
    HttpMethod: 'GET'
  condition: selection
falsepositives:

  - Legitimate use of ip-api.com geolocation service by approved applications
level: medium

7. Sources

• Help Net Security — "AI developers targeted via trojanized GitHub repositories" — https://www.helpnetsecurity.com/2026/08/04/developers-github-fake-ai-tools-infostealer/ — 2026-08-04
• Help Net Security — "Threat actor impersonated hundreds of brands on GitHub to push infostealer malware" — https://www.helpnetsecurity.com/2026/07/15/impersonated-brands-github-infostealer-download/ — 2026-07-15
• BleepingComputer — "Nearly 300 GitHub repos pose as legit software to push malware" — https://www.bleepingcomputer.com/news/security/nearly-300-github-repos-pose-as-legit-software-to-push-malware/ — (date not specified in source)
• Help Net Security — "AI agents tricked into recommending malicious GitHub repositories" — https://www.helpnetsecurity.com/2026/07/21/github-repos-malware-campaign-fakegit-ai-agents/ — 2026-07-21

8. Adverse Trace position

This is a high-severity threat for EMEA financial services organisations with active AI/ML development teams. The attack chain is technically sophisticated — blockchain-resolved C2, runtime API resolution via LuaJIT, multi-stage obfuscation — and specifically targets the developer workflow at the point of least friction: cloning a repository that looks legitimate. The infostealer endgame means credential compromise of cloud platforms, source-code repositories, and internal services is the primary risk. Attribution to a named actor is unconfirmed; the campaign is tracked by Netskope under the label "TroysDen's" and the technical detail is single-sourced to Netskope Threat Labs — verify IOCs against your own telemetry before enforcement. We will monitor for additional source corroboration, expanded IOC sets, and any CISA or national-CERT publications on this campaign. Clients should prioritise P1 containment actions immediately and audit repository provenance across all development teams.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.