FakeGit malware campaign returns with 17,610 malicious GitHub repos
FakeGit campaign reactivates, using 17,610 malicious GitHub repos to distribute SmartLoader malware.
The FakeGit malware campaign has resurfaced, leveraging over 17,610 malicious GitHub repositories to distribute the SmartLoader malware. Initially observed pushing the StealC infostealer, the campaign now focuses on SmartLoader, which acts as a dropper for other malware. Attackers are exploiting existing repositories and various file locations like forks and release assets, making traditional takedown methods ineffective.
AI summary of the linked source. Not reviewed by an editor. How this works
Run GitHub?
Get an email when a new story names GitHub, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe FakeGit campaign exploits developer trust in GitHub as a legitimate platform by seeding thousands of malicious repositories designed to mimic real projects, tricking developers into downloading SmartLoader malware. Attackers leverage repository forks and release assets to evade traditional takedown efforts, making the threat persistent and difficult to contain. This matters because developers routinely pull code from GitHub without rigorous vetting, creating a direct path for malware to enter software supply chains and enterprise environments. The shift from StealC to SmartLoader as a dropper demonstrates that adversaries are iterating rapidly, increasing the potential for multi-stage infections across downstream systems.
What helps against this
How we list vendors- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — SmartLoader
- malware — StealC