[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f82kYvTYJf2-qKmhOXZRC7soNTu7o75XleKNLS7VzV5k":3},{"article":4,"iocs":46,"watch_terms":53,"solutions":54,"lesson":141},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"da738b6f-c8c9-4ae6-a11d-02009916470f","FakeGit malware campaign returns with 17,610 malicious GitHub repos","fakegit-malware-campaign-returns-with-17-610-malicious-github-repos-91772b","More than 17,000 fake repositories on GitHub are distributing the SmartLoader malware after the FakeGit campaign reactivated earlier this month to push the StealC infostealer. [...]","The FakeGit malware campaign has resurfaced, leveraging over 17,610 malicious GitHub repositories to distribute the SmartLoader malware. Initially observed pushing the StealC infostealer, the campaign now focuses on SmartLoader, which acts as a dropper for other malware. Attackers are exploiting existing repositories and various file locations like forks and release assets, making traditional takedown methods ineffective.","FakeGit campaign reactivates, using 17,610 malicious GitHub repos to distribute SmartLoader malware.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Ffakegit-malware-campaign-returns-with-17-610-malicious-github-repos\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F10\u002F08\u002Fgithub.jpg","2026-10-08T17:10:55+00:00","2026-10-08T18:00:08.654367+00:00",8,[17,20],{"name":18,"type":19},"GitHub","product",{"name":21,"type":22},"FakeGit","campaign","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":23,"icon":25,"name":26,"slug":27},null,"Malware","malware",[29,34,36,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47,50],{"type":27,"value":48,"context":49},"SmartLoader","Malware distributed by FakeGit campaign",{"type":27,"value":51,"context":52},"StealC","Malware previously pushed by FakeGit campaign",[18],{"controls":55,"vendors":140},[56,84,111],{"slug":45,"name":57,"problem":58,"products":59},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"slug":85,"name":86,"problem":87,"products":88},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[89,96,103],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":85,"product_name":93,"url":94,"description":95},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":97,"product_name":100,"url":101,"description":102},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"slug":112,"name":113,"problem":114,"products":115},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[116,124,132],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",[],{"slug":142,"title":143,"body":144,"framework_refs":145,"framework_notes":155},"fakegit-campaign-uses-17000-malicious-github-repos-to-spread-malware","FakeGit Campaign Uses 17,000+ Malicious GitHub Repos to Spread Malware","The FakeGit campaign exploits developer trust in GitHub as a legitimate platform by seeding thousands of malicious repositories designed to mimic real projects, tricking developers into downloading SmartLoader malware. Attackers leverage repository forks and release assets to evade traditional takedown efforts, making the threat persistent and difficult to contain. This matters because developers routinely pull code from GitHub without rigorous vetting, creating a direct path for malware to enter software supply chains and enterprise environments. The shift from StealC to SmartLoader as a dropper demonstrates that adversaries are iterating rapidly, increasing the potential for multi-stage infections across downstream systems.",[146,147,148,149,150,151,152,153,154],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-161: Supply Chain Risk Management","NIST SP 800-218: Secure Software Development Framework (SSDF)","NIST CSF DE.CM-3: Personnel activity monitoring","NIST SA-12: Supply Chain Protection","SLSA Framework: Supply-chain Levels for Software Artifacts","OWASP Top 10: A08:2021 Software and Data Integrity Failures",{"NIST SA-12: Supply Chain Protection":156,"NIST SP 800-161: Supply Chain Risk Management":157,"NIST CSF DE.CM-3: Personnel activity monitoring":158,"CIS Control 7: Continuous Vulnerability Management":159,"CIS Control 14: Security Awareness and Skills Training":160,"CIS Control 2: Inventory and Control of Software Assets":161,"SLSA Framework: Supply-chain Levels for Software Artifacts":162,"OWASP Top 10: A08:2021 Software and Data Integrity Failures":163,"NIST SP 800-218: Secure Software Development Framework (SSDF)":164},"Supply chain protection requires vetting the origin of software, the check that would stop FakeGit's fake repositories reaching developer machines.","Supply chain risk management treats GitHub downloads as third-party components that must be vetted, the gap FakeGit's 17,000 repositories exploited.","Monitoring developer activity, such as downloads of unvetted release archives, helps detect SmartLoader infections early.","Vulnerability management of third-party code includes vetting dependencies and downloads before use, reducing exposure to FakeGit repositories.","Awareness training teaches developers to verify repository owners, stars and release assets before downloading, which is what FakeGit exploits.","A software inventory and allow list helps ensure developers only use approved code, not lookalike GitHub repositories carrying SmartLoader.","SLSA provenance lets developers verify that code and release artefacts genuinely come from the claimed project, not a FakeGit clone.","Software integrity failures include trusting unverified code and artefacts, exactly what FakeGit exploits by mimicking real GitHub projects.","The SSDF calls for acquiring third-party code from trusted sources and verifying it, which would stop developers running FakeGit's SmartLoader."]