FakeGit Malware Uses 17,610 GitHub Repositories to Deliver SmartLoader and StealC 

The FakeGit malware campaign reactivated on October 4, using 17,610 GitHub repositories to distribute SmartLoader and, through it, the StealC infostealer, according to Apiiro researchers. The operation pushed more than 13,000 repositories in its first 34 hours, reaching a peak of 2,999 repositories in one hour.

Key Points

• FakeGit returned on October 4 with a network of 17,610 repositories.
• The campaign uses repository download links to deliver malware, including the StealC infostealer.
• Apiiro said the operators redirected existing repositories rather than creating new ones for the renewed activity.
• Earlier FakeGit activity included repositories impersonating AI skills and Model Context Protocol servers.
• Apiiro recommends checking repository owners and using official sources for AI tools.

How the campaign works

Apiiro said the repositories use README instructions and a download button that links to a ZIP archive containing SmartLoader, an initial payload used to deliver other malware. In the renewed activity, SmartLoader was used to push the StealC infostealer.

In the commits Apiiro sampled, 97% changed only the README, while 88% directed the README download button to a ZIP that installs SmartLoader. Apiiro said the repositories were not necessarily created for the October activity. Researchers wrote: “Nobody had to create a single new repo. The fleet was already there. It just got re-aimed.”

The campaign relied mostly on throwaway accounts, but researchers identified at least 700 accounts that appeared to belong to legitimate developers, Apiiro said.

Earlier FakeGit activity

Similar activity involving different payloads had been observed since at least January. The name FakeGit was associated with the operation in July, when Island reported 7,600 fake repositories distributing SmartLoader. Island, an enterprise browser platform, also found 800 repositories posing as AI skills or Model Context Protocol servers in public AI registries and catalogs.

Why repositories remain available

Apiiro said repository-removal efforts rely on lists that cover only a fraction of the malicious repositories. The researchers found that blocklisted payloads and backup copies remained accessible, allowing operators to change download links while keeping repositories active. Before Apiiro’s report, 71% of the repository fleet was missing from URLhaus, the researchers said.

Apiiro noted that a domain-level DNS blocklist cannot block a single file hosted on GitHub without blocking GitHub itself. Researchers found malicious archives in repository forks, older files, release assets, issue attachments and separate download-hosting repositories. Apiiro described the available backups: “Delete one file and the operator can point the lure at a spare copy: a fork, an older ZIP, a release asset or an issue attachment.”

Apiiro recommends verifying a repository’s owner before using it and obtaining AI skills and Model Context Protocol servers from official registries or vendor repositories. If SmartLoader execution is suspected, the researchers advise treating it as a potential GitHub account compromise, revoking active sessions and access tokens, and moving to passkeys.