FakeGit Campaign Uses 17,610 GitHub Repositories to Spread SmartLoader
Security researchers have uncovered a massive campaign involving over 17,000 GitHub repositories that use deceptive software projects to distribute the SmartLoader malware and steal user credentials.
Security researchers identified FakeGit, a campaign using 17,610 repositories hosted on GitHub. These projects mimic legitimate software with polished documentation and download buttons. Developers and users downloading open-source privacy, cybersecurity, and cryptocurrency utilities face infection risks.
The repositories distribute SmartLoader, a malware loader linked to the StealC information stealer. The software harvests credentials and browser session data upon execution. Some accounts mimic profiles of established developers to gain credibility.
Attackers update existing repositories rather than creating new accounts. This repurposing maintains delivery mechanisms while redirecting visitors to updated download links. The strategy lets the campaign persist using the history of existing repositories.
The 17,610 figure represents total observed inventory and does not reflect currently active repositories. The investigation demonstrates that hosting a project on a code platform does not guarantee safety. Attackers can compromise genuine accounts or create deceptive pages, requiring caution when downloading code from external projects.