FakeGit Campaign Floods GitHub with 7,600 Fake Repositories to Distribute SmartLoader Malware
The FakeGit campaign has turned GitHub into a massive storefront of deceptive repositories aimed at distributing SmartLoader, a loader designed to install follow-on malware such as the StealC infostealer. The operation, active at least until July 2026, has created or repurposed nearly 7,600 repositories and employs a sophisticated mix of cloned legitimate projects, realistic documentation, and fake developer profiles to appear trustworthy.
Visitors are guided to download ZIP archives from GitHub Releases, a channel often perceived as more reliable. Approximately 200 of these repositories have recorded more than 14 million downloads, demonstrating the campaign’s significant reach. In roughly 800 cases the repositories masquerade as AI-related utilities, specifically presented as Skills or MCP (Model Context Protocol) servers.
This approach enables the AgentBaiting technique, in which attackers do not need to send direct links; instead, they rely on AI agents searching for free skills or MCP servers and subsequently following installation instructions that execute malicious code. Internal tests have shown that systems including Anthropic Claude Code, Google Gemini, and OpenAI ChatGPT can surface malicious repositories during discovery.
The infection chain begins with the downloaded ZIP, which triggers a staged payload executed through LuaJIT and culminating in an obfuscated Lua script that installs SmartLoader. The loader maintains persistence on Windows via scheduled tasks and resolves its command-and-control infrastructure dynamically using a blockchain-based dead drop referencing a smart contract on Polygon.
Exposure is further amplified by more than 600 listings appearing on public directories such as LobeHub, Glama, MCP.so, and MCP Market. Organizations are recommended to avoid executing unverified ZIP files or scripts, maintain internal catalogs of approved AI components, apply application control policies, and monitor for LuaJIT execution and anomalous network activity including direct IP connections or Polygon RPC endpoints.
Related articles
redb 3.7.2 Released with Custom gRPC Protocol, Dependency Vulnerability Fixes and .NET 10 Migration
The redb ecosystem released versions 3.7.0, 3.7.1 and 3.7.2 in quick succession after 3.7.0 was withdrawn due to high-severity vulnerabilities in its .NET 9 build artifacts. NuGet audit detected issues only on full rebuilds, leading to updates for SSH.NET, Microsoft.Data.Sqlite, System.Security.Cryptography.Xml and Microsoft.Bcl.Memory across redb.Route, redb.Core, redb.Export and redb.Identity. The release introduces a native GrpcWire implementation that registers individual gRPC methods as routes on a shared Kestrel host, supports bidirectional streaming, real gRPC status codes and mTLS with pinned client certificates. redb.Route also gained a dedicated SOAP connector, Control Bus messaging for route lifecycle management and a corrected Claim Check pattern. File transports received critical fixes that prevent silent data loss when readLock and idempotency options are combined. All libraries now target net8.0;net9.0;net10.0 while host applications require .NET 10, aligning with Microsoft’s shortened support timeline for .NET 8 and 9.
Poisoned Rust Crates Execute Malware at Build Time: 245 Million Downloads Hit in Supply-Chain Attack
Three widely used Rust crates on crates.io were poisoned on August 20 with malicious versions that execute automatically during cargo build. The attack leveraged a typosquatted proc-macro1 dependency containing a build script that downloads payloads and establishes persistence. arrayref alone has accumulated 245 million downloads and is pulled automatically through caret ranges in many dependency trees. Attack infrastructure overlaps with prior campaigns attributed to Sapphire Sleet and MIDNIGHT NEPTUNE. Rust security teams yanked the malicious releases within 86-107 minutes, but the incident highlights missing publish-age controls and weak maintainer-account protections in the Cargo ecosystem.
PyPI Explores Prefix Reservation for Organizations Under PEP 752 to Prevent Name Squatting
PEP 752 proposes reserving package name prefixes for organizations on PyPI, allowing control over entire families of related package names rather than individual entries. The change addresses dependency confusion and name squatting risks where attackers register packages with familiar prefixes like google-cloud- or opentelemetry- to exploit user trust. Analysis of over 800,000 PyPI projects by CodeScoring shows that prefixes are rarely controlled by a single owner, with ecosystems like aws- managed by hundreds of accounts. The proposal introduces implicit namespaces and new metadata for clients and proxies while preserving the flat namespace model familiar to Python developers. PEP 755 will define the governance process for granting prefix rights, limiting applications to organizations and requiring clear justification. Existing packages receive backward compatibility exceptions, and the mechanism does not transfer across repositories.
Suspicious Certificate Issuer Detected in MAX Messenger Windows Update Package
A detailed observation from a security researcher highlights an unexpected change in the code signing certificate for the MAX messenger desktop client on Windows. The August update package was signed by an individual named Konstantin Syomochkin instead of the usual Communication Platform LLC. This discrepancy raised concerns about potential supply chain interference linked to recent EU sanctions against the developer. The certificate was issued shortly after sanctions and belongs to a person based in Astana, Kazakhstan, with limited public ties to the VK team. Official MSI installers downloaded directly from the MAX website remain signed by the company, while the client-triggered update differs in both version and signer. The researcher recommends that VK verify the download chain through Mail.ru trackers to rule out tampering. Installation of the update was declined pending further clarification.