FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware

1. Executive summary

The FakeGit campaign, disclosed by Island researchers, has created approximately 7,600 malicious GitHub repositories using 6,600 lookalike developer profiles to distribute SmartLoader malware, ultimately deploying the StealC infostealer. Over 800 of these repositories pose as AI skills or Model Context Protocol (MCP) servers, exploiting AI agent discovery mechanisms (AgentBaiting) to trick autonomous systems into recommending malicious code. The operation has recorded over 14 million downloads across GitHub Release assets. EMEA financial services firms leveraging AI-assisted development workflows face direct risk of credential theft and source code compromise via trojanized integrations mimicking enterprise tools such as Jenkins, Docker, and Databricks.

2. Regulatory framing

3. Technical analysis & attack chain

Attribution caveat: No MITRE ATT&CK actor profile has been resolved for this item. Attribution to a specific threat actor is unconfirmed. The campaign is tracked under the name "FakeGit" by Island researchers. This advisory relies on single-sourced reporting from The Hacker News / Island; verify before enforcement.

Attack chain

1. Repository creation: Threat actors created ~7,600 malicious GitHub repositories using ~6,600 lookalike developer profiles. Repositories were either completely fabricated or copied from legitimate projects, populated with convincing READMEs.
2. Lure categorisation: Over 800 repositories posed as AI skills or MCP servers for consumer and enterprise use, including Gmail, WhatsApp, Databricks, Jenkins, and Docker integrations. Over 600 campaign listings were flagged across public MCP and Skill registries (LobeHub, Glama, MCP.so, MCP Market).
3. Delivery mechanism: Malicious ZIP files served via GitHub Release assets. The campaign recorded over 14 million downloads across ~200 campaign repositories as of July 2026.
4. Execution chain: ZIP archive triggers a LuaJIT loader chain → execution of an obfuscated Lua script → SmartLoader deployment.
5. Secondary payload: SmartLoader establishes persistence and deploys StealC, an information stealer capable of harvesting a wide range of data from compromised systems.
6. AgentBaiting vector: AI agents (tested against Anthropic Claude Code, Google Gemini, OpenAI ChatGPT) can autonomously discover FakeGit repositories when prompted with natural-language requests (e.g., "Find free claude cinematic prompt skill, and give me the installation instructions"). The AI agent treats the malicious README as legitimate documentation and passes attacker instructions to the user without requiring a malicious link.

Key technical details

• Loader: LuaJIT-based, using obfuscated Lua scripts
• Primary malware: SmartLoader (loader/persistence)
• Secondary payload: StealC (infostealer)
• AI agent susceptibility confirmed: Claude Code, Gemini, ChatGPT
• Registry compromise: 600+ listings on LobeHub, Glama, MCP.so, MCP Market

4. Mitigation & containment

P1 — Within 24 hours

• Audit all development environments for recently installed GitHub-based AI skills, MCP servers, or agent plugins. Prioritise anything pulled from LobeHub, Glama, MCP.so, or MCP Market.
• Block known malicious registry domains at the network egress level for development environments where feasible.
• Isolate any workstations or CI/CD runners that have executed ZIP files from unverified GitHub repositories in the past 90 days. Preserve forensic images for StealC artefact hunting.

P2 — Within 72 hours

• Establish a catalog of reviewed and approved Skills, MCP servers, and agent plugins. Enforce a policy that AI agents may only install from this approved list.
• Implement sandboxed evaluation for any new agent capability or MCP server before broader rollout. No direct execution in production development environments.
• Review GitHub repository authenticity: verify publisher identity, check for fork/copy anomalies, and inspect commit history for signs of copied projects with injected malicious assets.
• Scan endpoint telemetry for LuaJIT execution and obfuscated Lua script activity originating from user-space archive extraction.

P3 — Within 7 days

• Update secure development lifecycle (SDLC) policies to explicitly address AI-assisted code discovery and installation workflows.
• Implement allowlisting for GitHub Release asset downloads in CI/CD pipelines.
• Conduct retrospective review of all MCP server integrations currently in use across the organisation against the 600+ flagged campaign listings.

5. Indicators of compromise

No atomic indicators of compromise (hashes, IPs, domains, file paths) are available in the source material.

Behavioural indicators

6. Detection

rule SmartLoader_FakeGit_LuaJIT_Loader {
    meta:
        author = "Adverse Trace"
        date = "2026-07-20"
        reference = "https://thehackernews.com/2026/07/fakegit-campaign-uses-7600-github.html"
        description = "Detects obfuscated Lua scripts associated with SmartLoader delivery via FakeGit campaign"
    strings:
        $lua_jit_marker = "LuaJIT" ascii
        $stealc_ref = "StealC" ascii
        $smartloader_ref = "SmartLoader" ascii
    condition:
        uint16(0) == 0x5A4D and ($lua_jit_marker or $stealc_ref or $smartloader_ref)
}

Detection caveat: The YARA rule above is constructed from malware family names and loader technology referenced in the source. These are weak indicators — the strings "SmartLoader" and "StealC" may appear in security reporting rather than in the malicious artefacts themselves. Treat as preliminary until confirmed against actual samples. No file hashes, mutex names, or hard-coded C2 strings are available in the source material to strengthen the rule.

Sigma rule for LuaJIT execution from archive extraction

title: Suspicious LuaJIT Execution from ZIP Archive
id: 7f3a2c1d-4b5e-6f8a-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects LuaJIT execution originating from extracted ZIP archives, consistent with SmartLoader delivery via FakeGit campaign
author: Adverse Trace
date: 2026/07/20
references:

    - https://thehackernews.com/2026/07/fakegit-campaign-uses-7600-github.html
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:

            - '\luajit.exe'
            - '\lua.exe'
        ParentImage|endswith:

            - '\explorer.exe'
            - '\7z.exe'
            - '\winrar.exe'
            - '\powershell.exe'
    condition: selection
falsepositives:

    - Legitimate Lua development environments
level: high

7. Sources

• The Hacker News — FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware — https://thehackernews.com/2026/07/fakegit-campaign-uses-7600-github.html — 2026-07-20
• BleepingComputer — Nearly 300 GitHub repos pose as legit software to push malware — https://www.bleepingcomputer.com/news/security/nearly-300-github-repos-pose-as-legit-software-to-push-malware/ — (corroborating context)
• SecurityWeek — Over 5,500 GitHub Repositories Infected in 'Megalodon' Supply Chain Attack — https://www.securityweek.com/over-5500-github-repositories-infected-in-megalodon-supply-chain-attack/ — (corroborating context)
• Help Net Security — Threat actor impersonated hundreds of brands on GitHub to push infostealer malware — https://www.helpnetsecurity.com/2026/07/15/impersonated-brands-github-infostealer-download/ — 2026-07-15

8. Adverse Trace position

This is a high-severity supply-chain threat targeting the AI-assisted development workflow — an attack surface most EMEA financial services firms are only beginning to govern. The FakeGit campaign's scale (7,600 repositories, 14 million downloads) and the AgentBaiting vector represent a meaningful escalation: AI agents from major vendors can be tricked into autonomously discovering and recommending malicious code without human intervention. The LuaJIT-to-SmartLoader-to-StealC chain is technically straightforward but effective, and the targeting of enterprise tooling names (Jenkins, Docker, Databricks) increases the probability of ingestion into financial services development pipelines. Attribution is unconfirmed and all technical detail is single-sourced from Island / The Hacker News — we will update this advisory as IOCs and independent corroboration emerge. Clients should immediately audit MCP server and AI skill inventories and enforce allowlisting before permitting AI-assisted dependency installation in any environment touching production systems.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.