FakeGit: A 17,610-Repository GitHub Campaign Delivering SmartLoader and StealC

1. Basic Information

• Article Title: Never Deleted, Only Re-Pointed: Inside the 17,600-Repo FakeGit Fleet That Re-Arms Overnight
• Publisher: Apiiro
• Publication Date: 2026-10-06
• Original: Apiiro
• Related Sources: BleepingComputer
• Associated Malware & Threat Groups: SmartLoader, StealC, FakeGit operator
• Associated CVE: None specified
• Associated Products: GitHub
• Severity: Critical

2. Brief Summary

FakeGit rapidly re-arms large-scale malware distribution infrastructure by modifying only the README files of long-standing fake repositories or compromised developer accounts to re-point download links to SmartLoader.

3. Attack Flow

From Re-Pointing to Credential Theft

1. Attackers maintain existing fake repositories and compromised developer accounts.
2. An automated script rewrites only the download button in the README to point to a new ZIP file.
3. Users download a ZIP archive from a repository that appears legitimate, extract it, and run the launcher inside.
4. SmartLoader launches and delivers secondary payloads such as StealC.
5. Stolen credentials and sessions may be used for subsequent compromises of developer accounts or cloud environments.

4. Attacker Positioning and Execution Location

• Attackers operate repositories, accounts, and release assets on GitHub, luring victims from outside the developer's trust boundary.

5. Victim and Administrator Perspective

• Users: Run a launcher extracted from a ZIP archive presented as an installer for a legitimate GitHub project.
• Administrators: Observe README-only commits, modified download URLs, SmartLoader activity, and browser or GitHub token access.

6. Success and Failure Conditions

Success Conditions

• Users mistake a fake repository for a legitimate one and run the launcher contained in the downloaded ZIP archive.
• Endpoint defenses fail to block SmartLoader and secondary payloads.

Failure Conditions and Mitigations

• Verify official sources, signatures, and release provenance, and avoid running files from untrusted ZIP archives.
• Analyze suspicious downloads in an isolated sandbox, use EDR or application control to prevent malicious execution on endpoints, and revoke exposed sessions and tokens.

7. Outcomes upon Success

• Credential and session theft via SmartLoader and StealC.
• Potential escalation to developer account takeover or unauthorized pushes to other repositories due to the abuse of stolen information. The initial compromise methods for existing account takeovers identified by Apiiro remain unconfirmed.
• Potential subsequent access to cloud environments, source code, and CI/CD pipelines.

8. Observable Logs

The following items are candidate investigative areas within your organization and do not necessarily represent events observed in this specific incident.

• Email: Email is not a required vector. Victims are lured via search engines, GitHub, or AI catalogs.
• Proxy / SWG / DNS: Observe ZIP files on GitHub, release assets, issue attachments, and frequently changing download URLs.
• Endpoint / EDR: Observe ZIP extraction, SmartLoader, StealC, browser data access, and token file access.
• Identity / IdP: Observe unusual logins, token and credential usage, permission changes, and service account operations.
• SaaS / Cloud: Observe management APIs, audit logs, repository and cloud resource access, and mass downloads.
• Network: Observe unfamiliar C2 communications following GitHub downloads, credential theft, and additional payload retrieval.

9. Assessing Attack Success

Confirmed in Public Information

• Apiiro substantiated 17,610 live lure repositories distributing SmartLoader ZIP files and 219 compromised legitimate developer accounts.
• The initial compromise methods for these accounts and the causal relationship with SmartLoader and StealC infections remain unconfirmed. Repository counts and account counts should not be treated as the number of successful malware executions on endpoints.

Internal Evaluation Criteria

• Attack Attempt Observed (Success Unconfirmed): Confirm interaction with malicious repositories or ZIP file downloads. Downloading alone does not indicate successful malware execution.
• Malware Execution or Authentication Success Confirmed: Confirm execution evidence of SmartLoader or StealC, or unauthorized use of accounts, sessions, or tokens. Do not conclude execution or authentication success based solely on C2 traffic.
• Subsequent Compromise Confirmed: Confirm unauthorized repository modifications or access to other systems, and investigate the causal relationship with prior endpoint compromises.
• Correlate requests, processes, authentication, data access, and outbound transmissions to distinguish between attack attempts and successes.
• Do not determine success based solely on HTTP status codes or single alerts when such success is absent from public information.

10. Investigation Playbook

• Investigation Origin: Start from malicious GitHub ZIP downloads, SmartLoader detections, or mass README-only updates on repositories.
• Initial Verification: Record the repository and owner, README revision, download URL, archive hash, download time, affected endpoint, evidence of launcher execution, and containment timestamps.
• Endpoint and Server Investigation: Check browser downloads, ZIP files, process trees, credential stores, GitHub CLI and token files, and persistence mechanisms.
• Authentication and Cloud Investigation: Check suspicious accounts, tokens, API usage, permission changes, unusual connection sources, and resource access.
• Subsequent Operations: Trace post-incident credential access, lateral movement, additional downloads, outbound transmissions, and account creation.
• Containment: Isolate endpoints, revoke GitHub and cloud sessions, tokens, and SSH keys, and roll back repository changes.
• Judgment Categories: Separate discovery and attack attempts, initial execution, authentication success, information theft, and subsequent compromise.

11. Defense and Detection Ideas

• Single Events: Detect SmartLoader execution originating from GitHub ZIPs and README-only link changes.
• Temporal Correlation: Correlate GitHub downloads -> ZIP extraction and launcher execution -> SmartLoader -> StealC -> token usage -> repository pushes.
• Threat Hunting: Search for Apiiro's repository list, ZIP hashes, README modifications, and internal access by compromised accounts.
• Log Limitations: Domain-level blocking cannot selectively block a malicious file hosted on GitHub without also blocking GitHub. URL-based blocklists may lag behind rapid link changes.
• Priority Mitigations: Prioritize official source verification, signatures, EDR, token least privilege, passkeys, and session revocation.

12. Facts, Inference, and Hypothesis

Facts

• Apiiro identified SmartLoader ZIP files across 17,610 live lure repositories, with a total of 18,864 repositories including download hosts and forks.
• Over a 34-hour period from October 4 to October 5, 2026, 79% of the fleet was re-pushed, with 97% of sampled commits modifying only the README and 88% updating buttons to point to SmartLoader ZIPs.
• 71% of the lure repositories were absent from Apiiro's pre-report URLhaus snapshot, while 99.96% of the ZIP files listed in URLhaus remained downloadable.
• Of 15,225 accounts, 14,219 appeared to be throwaway accounts. Apiiro estimated that roughly 700 were real developers' accounts that had been taken over; this estimate includes 219 accounts individually substantiated through third-party historical evidence.
• Attack kits were also placed in 167 AI skill folders, utilizing StealC as the final payload.

Inference

• Repository creation dates, star counts, and owner names alone cannot be trusted; download URL change histories and artifact provenance must be verified.
• Developer endpoints that executed SmartLoader may have had GitHub tokens or cloud sessions stolen, and should be treated as credential incidents rather than simple malware cleanups.

Hypothesis

No additional hypotheses. Unconfirmed items are documented in "14. Open Questions and Further Investigation".

13. MITRE ATT&CK Mapping

ID	Technique	Confidence	Basis
T1195.001	Compromise Software Dependencies and Development Tools	high	Leverages fake repositories and compromised developer accounts to lure developer downloads toward malware.
T1036	Masquerading	high	Employs repositories, READMEs, and developer identities disguised as legitimate projects.
T1204.002	User Execution: Malicious File	high	Users run a malicious launcher contained in a ZIP archive downloaded through a README link.

14. Open Questions and Further Investigation

• Current deletion status of all 17,610 repositories and permanent mitigation measures by GitHub.
• Initial compromise methods for each developer account and the scope of secondary utilization following StealC infections.
• Secondary payloads across all ZIP files and the total number of compromised endpoints.

15. Impact on SOCs and Organizations

Developers obtaining tools, AI skills, and MCP servers from GitHub face similar risks. The source does not confirm direct targeting of Japan or affected victims in Japan. Organizations should prioritize official vendor repositories, signed releases, and package managers, while inspecting repositories with abruptly updated README files, direct ZIP links, and issue attachments. If malicious execution is suspected, immediately revoke GitHub and cloud sessions and tokens.

16. Summary by Target Audience

• For SOCs: Correlate GitHub ZIP downloads, SmartLoader processes, StealC, token access, and mass README updates from single accounts.
• For Administrators: Implement official source allowlists, artifact signatures, token least privilege, passkeys, and organizational audit log monitoring.
• For Users: Do not run files obtained through README download buttons without verifying their source. Check the official vendor repository and signed releases.