FakeGit malware campaign returns with 17,610 malicious GitHub repos
FakeGit returned with 17,610 GitHub repositories distributing SmartLoader and the StealC infostealer.
Apiiro says the FakeGit campaign resumed on October 4 and is using 17,610 GitHub repositories to distribute SmartLoader, which then delivers the StealC infostealer. In 34 hours the operator pushed more than 13,000 repositories, peaking at 2,999 an hour. In sampled commits, 97% changed only the README and 88% pointed a Download button at a ZIP that installs SmartLoader. Island previously tied the operation to 7,600 fake repositories in July, including about 800 posing as AI skills or MCP servers.
78