SmartLoader — Malware Profile
SmartLoader is a Lua-based malware loader distributed in ZIP archives that pair an obfuscated Lua script with a legitimate LuaJIT interpreter (luajit.exe and lua51.dll) and a batch file that runs it, leaving the script as the only malicious component in the archive. Trend Micro documented it in March 2025 spreading through fake GitHub repositories with AI-generated README files that posed as game cheats, cracked software and cryptocurrency utilities, with SmartLoader serving as the delivery stage for Lumma Stealer; campaigns documented in 2024 used the same Lua chain to deploy RedLine Stealer and the CypherIT loader/crypter. Later analysis by Hexastrike Cybersecurity found samples obfuscated with Prometheus that resolve their command-and-control address from a Polygon smart contract over JSON-RPC, exfiltrate host fingerprinting details and screenshots in a multipart/form-data POST, and retrieve an encrypted StealC payload. Island reported in July 2026 that the associated FakeGit campaign had grown to roughly 7,600 malicious repositories, more than 800 of which impersonated AI Skills or MCP servers.