A malware campaign that disguises itself as ordinary open-source projects on GitHub has returned at more than double its previous size. The FakeGit operation reactivated on October 4 and is now spread across 17,610 fake repositories, according to a Rewterz threat advisory summarising the latest findings from researchers at Apiiro.
The repositories push SmartLoader, a malware loader whose job is to fetch and install further payloads, including the StealC information stealer. Anyone who downloads software, AI skills or Model Context Protocol (MCP) servers from an unfamiliar GitHub page is a potential target, and developers are the obvious prize because their machines hold source code, tokens and access to other systems.
Thirteen thousand repositories re-aimed in a day and a half
FakeGit first drew attention in July, when researchers counted about 7,600 malicious repositories, some of them posing as AI skills and MCP servers. The October resurgence was fast. The operators updated more than 13,000 repositories within 34 hours, peaking at 2,999 repositories an hour.
The changes were small and targeted. In the sample the researchers examined, 97% of commits touched only the README file, and 88% pointed the README's download button at a ZIP archive that installs SmartLoader. Most accounts behind the repositories are disposable, but at least 700 appear to belong to legitimate developers, which makes the lure more convincing.
Why takedowns have not worked
The striking finding is that blocking the malware does not kill the campaign. The repositories stay up even when a payload or download link is blocklisted, so the operators simply swap the link. Backup copies of the archives are scattered across repository forks, older files, release assets, issue attachments and separate hosting repositories, giving them plenty of places to redirect to. The researchers reported that 71% of the malicious repositories were not listed in the URLhaus malware database before their investigation.
GitHub's reach has been turned against its users before, as in August when attackers used stolen GitHub tokens to clone thousands of repositories. FakeGit's twist is that the infrastructure belongs to someone else and is not going anywhere.
Download from official registries, and treat an infection as a GitHub breach
Rewterz advises users to verify who owns a repository before downloading anything, and to get AI skills, MCP servers and developer tools only from official registries or the vendor's own repositories. Security teams should watch for unexpected ZIP downloads from GitHub on developer endpoints, inspect archives in a sandbox before they run, and hunt for SmartLoader activity.
If someone has already run one of these archives, treat it as a potential GitHub account compromise: revoke active sessions and access tokens, rotate exposed credentials, review account activity, and move developer accounts to phishing-resistant authentication such as passkeys.
Indicators
A selection of the indicators published with the advisory (IPs defanged):
- IP: 194[.]48[.]248[.]94
- IP: 185[.]10[.]68[.]110
- SHA-256: 8cede35b80b1deaf732c2b178d908f91b3e7a0c114d06dfae9075b8a9bf78b8f
- SHA-256: f9436ccb986760ca379d6cd2f00726e032a1d9c250a9bd261d40d98b914e7ef9
- SHA-256: 73f3c4ae76c086f962a06d790be6cc104a47c9d1bfcaebd12eebb3455b090660
FakeGit's lesson is uncomfortable for anyone who relies on blocklists. When the lure lives on a platform everyone trusts, removing the payload only buys time, and the fake project page is still there waiting for the next link.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.