The FakeGit malware campaign has resumed operations, using 17,610 malicious GitHub repositories to distribute SmartLoader. The latest wave uses the loader to deliver StealC, malware designed to steal information.
Researchers at software supply-chain security firm Apiiro traced the renewed activity to October 4. Although the operation relies mainly on disposable accounts, they also identified at least 700 accounts that appear to belong to legitimate developers.
Fake Download Buttons Deliver Malware
The repositories present convincing README pages with installation instructions and prominent download buttons. However, those buttons direct visitors to ZIP archives containing SmartLoader rather than the advertised software.
SmartLoader then serves as a delivery mechanism for additional malware. In this wave, researchers linked the activity to StealC.
The campaign’s rapid expansion largely involved changes to existing repositories. Within 34 hours, the operation pushed updates across more than 13,000 repositories, reaching a peak of 2,999 per hour.
Among the commits Apiiro sampled, 97% changed only the README file. Meanwhile, 88% directed the download button to a ZIP archive that installs SmartLoader.
These findings suggest the attackers reused an established network of repositories by changing their download destinations.
Earlier Repositories Posed as AI Tools
Researchers have observed similar activity involving various malware payloads since at least January. However, the FakeGit name became associated with this operation in July.
At that time, researchers at enterprise browser company Island documented 7,600 fake GitHub repositories distributing SmartLoader.
Around 800 of those repositories posed as AI skills or Model Context Protocol (MCP) servers. Some also appeared in public AI registries and catalogs, giving users additional opportunities to encounter them.
The latest findings show that the FakeGit malware campaign retained enough infrastructure to launch another large distribution wave.
Backup Payloads Help the Campaign Stay Active
According to Apiiro, repository removal efforts have covered only part of the malicious network. Before its report, 71% of the identified repositories were absent from URLhaus, a service that tracks malware distribution URLs.
Furthermore, blocking a known download does not necessarily remove the attacker’s other copies.
Researchers found malicious archives in repository forks, older files, release assets, issue attachments, and separate repositories used for hosting downloads.
As a result, attackers can replace a removed download link with another location while keeping the original lure online.
Domain-level DNS blocking also offers limited precision here. It cannot block an individual malicious file hosted on GitHub without blocking access to the wider domain.
Repository Ownership Deserves Closer Checks
Apiiro recommends checking who owns a repository before downloading or running its contents. For AI skills and MCP servers, users should favor official registries or vendor repositories.
However, the earlier appearance of malicious projects in public catalogs shows why a listing alone does not establish trustworthiness.
If users suspect SmartLoader has executed, researchers recommend treating the incident as a potential GitHub account compromise. Their guidance includes revoking active sessions and access tokens, alongside moving to passkeys.
0 responses to “FakeGit Malware Campaign Returns With 17,610 GitHub Repositories”