FakeGit Campaign Uses 7,600 GitHub Repos to Push SmartLoader Malware

FakeGit: Malware at Developer Scale

A massive malware distribution campaign dubbed FakeGit has weaponized GitHub itself as a delivery platform, creating 7,600 malicious repositories that have accumulated more than 14 million total downloads. The operation pushes SmartLoader — a multi-stage malware loader — which subsequently installs StealC, a credential-stealing infostealer targeting browser data, cryptocurrency wallets, and application credentials.

The campaign represents one of the largest observed abuses of GitHub as a malware distribution channel, exploiting developer trust in the platform to deliver malware at scale.

How FakeGit Works

The FakeGit campaign exploits developer trust in GitHub and the platform's reputation as a legitimate source of open-source software. The operation operates across several stages:

Campaign Flow:
1. Create GitHub repos mimicking legitimate tools, libraries, or utilities
2. Populate repos with convincing README files, fake stars, and apparent activity
3. Embed SmartLoader within downloads (releases, archives, or "required" binaries)
4. Victims download and execute "tools" — SmartLoader activates
5. SmartLoader fetches and installs StealC payload
6. StealC exfiltrates credentials, cookies, and wallet data

Repository Characteristics

The malicious repositories were engineered to appear legitimate:

• Spoofed tool names — mimicking popular developer utilities, game cheats, cracked software, or automation tools
• Convincing presentation — README files, screenshots, and fake usage documentation
• Volume strategy — 7,600 repos across many accounts makes takedown difficult and detection harder
• Download scale — 14 million+ downloads indicates the campaign ran for an extended period before broad detection

The Malware: SmartLoader and StealC

SmartLoader

SmartLoader is a multi-stage loader — its primary function is to download, decrypt, and execute secondary payloads while evading detection. Key characteristics:

StealC

StealC is a well-documented infostealer that has been active since 2023. It targets a broad range of sensitive data:

StealC exfiltrates all collected data to attacker-controlled infrastructure and is typically sold as malware-as-a-service (MaaS) in underground forums, meaning multiple threat actors may be using it.

Scale and Impact

The FakeGit campaign's numbers are striking:

14 million downloads across 7,600 repositories represents significant operational scale. Even if only a fraction of downloads resulted in execution, the potential victim count numbers in the tens to hundreds of thousands.

Why GitHub?

GitHub is an attractive malware distribution platform because:

1. Inherent trust — developers habitually download code from GitHub without the suspicion they might apply to other sites
2. No-cost hosting — free repository hosting with no verification requirements for account creation
3. SEO and discoverability — GitHub repos appear in search engine results, driving organic traffic
4. CDN-backed downloads — GitHub's release hosting is fast, reliable, and CDN-served, making payloads download quickly
5. Abuse-resistant perception — security tools and corporate firewalls often whitelist GitHub by default

This is not the first time GitHub has been abused at scale — campaigns like Glassworm and prior infostealer campaigns have exploited similar trust dynamics.

Who Is at Risk?

FakeGit primarily targets:

• Developers searching for utilities, libraries, or automation tools
• Gamers seeking cheat software or game modification tools
• Power users looking for cracked or pirated software
• IT professionals downloading scripts or tools from unofficial sources

The credential theft focus of StealC makes developers particularly high-value targets — compromised developer credentials can enable supply chain attacks if the stolen credentials include code signing certificates, cloud provider keys, or package registry tokens (npm, PyPI, etc.).

Detection

Indicators to Watch For

Behavioral Indicators:
- Unexpected PowerShell or cmd.exe spawned from downloaded executables
- Outbound connections to unusual domains/IPs shortly after tool execution
- Unexpected reads of browser profile directories
- Crypto wallet file access outside of browser processes
- New scheduled tasks or registry run keys after software installation

File Indicators:
- Downloaded archives containing unexpected .exe files alongside claimed tool
- Executables with mismatched icons or no version metadata
- Unsigned binaries claiming to be popular tools

Scanning for StealC

# Check for StealC-related persistence (Windows)
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
 
# Check scheduled tasks
schtasks /query /fo LIST /v | findstr /i "task\|run\|command"
 
# Review recently created executables in temp directories
dir %TEMP% /od /a-d | findstr /i ".exe .dll .bat .ps1"

Protective Measures

For Individual Developers

1. Verify repository legitimacy before downloading — check account age, contribution history, and whether the repo is a fork or original
2. Prefer official package managers (npm, pip, cargo, etc.) over direct GitHub downloads for dependencies
3. Scan downloaded executables with an AV or VirusTotal before execution
4. Use sandboxed environments (VM, container) when testing unfamiliar tools
5. Enable MFA on GitHub — protect your own account from being used to distribute malware
6. Monitor browser credential stores — use a password manager rather than relying on browser-saved passwords

For Organizations

Developer Security Controls:
1. Software composition analysis (SCA) tools in CI/CD pipelines
2. Allowlist approved sources for tool downloads
3. Endpoint detection with behavioral analytics for post-execution activity
4. Privileged access management — developers should not run as local admin
5. Network egress monitoring for unusual outbound connections
6. Security awareness training covering supply chain risks

GitHub's Response

GitHub actively removes repositories used to distribute malware when reported. Organizations and individuals can report malicious repositories via GitHub's abuse reporting mechanism. The sheer scale of FakeGit (7,600 repos) highlights the ongoing challenge platforms face in detecting coordinated abuse at scale before significant harm occurs.

BleepingComputer first reported the FakeGit campaign. CosmicBytez Labs will update this article as GitHub's takedown progress and additional technical indicators become available.

Related Reading

• Glassworm Supply Chain Attack Abuses 72 Open VSX Extensions
• CanisterWorm: Blockchain C2 Self-Spreading npm Worm
• Trivy Supply Chain Attack Targets CI/CD Secrets