SmartLoader (Malware): news timeline & CVEs

Stolen AI API keys are paying for hackers’ autonomous scans

Bitsight says criminals sell MONST3R-AI, which uses stolen AI API keys to fund autonomous scans.

Bitsight tracked underground forums from February through August 2026 and found a seller offering MONST3R-AI, an autonomous scanning panel that runs on stolen OpenAI, Anthropic, and Google API keys so the key owner is billed. The seller claimed 1,072 findings on 199 hosts, which Bitsight could not verify. AI-related posts rose 45%, jailbreak discussion about 75%, while ransomware mentions fell 49%. Separately, the Water Kurita-linked FakeGit campaign used roughly 7,600 fraudulent GitHub repositories, more than 800 posing as AI skills or MCP servers, to spread SmartLoader.

Help Net SecurityOct 16, 05:00 UTC · 1d agoAI safety & security in the wild3· 1 read

FakeGit malware campaign returns with 17,610 malicious GitHub repos

FakeGit returned with 17,610 GitHub repositories distributing SmartLoader and the StealC infostealer.

Apiiro says the FakeGit campaign resumed on October 4 and is using 17,610 GitHub repositories to distribute SmartLoader, which then delivers the StealC infostealer. In 34 hours the operator pushed more than 13,000 repositories, peaking at 2,999 an hour. In sampled commits, 97% changed only the README and 88% pointed a Download button at a ZIP that installs SmartLoader. Island previously tied the operation to 7,600 fake repositories in July, including about 800 posing as AI skills or MCP servers.

BleepingComputerOct 8, 17:10 UTC · 8d agoMalware in the wild1

SmartLoader

Timeline2 articles

Appears with

Stolen AI API keys are paying for hackers’ autonomous scans

FakeGit malware campaign returns with 17,610 malicious GitHub repos