FakeGit Campaign Floods GitHub with 7,600 Fake Repositories to Distribute SmartLoader Malware
The FakeGit campaign has turned GitHub into a massive storefront of deceptive repositories aimed at distributing SmartLoader, a loader designed to install follow-on malware such as the StealC infostealer. The operation, active at least until July 2026, has created or repurposed nearly 7,600 repositories and employs a sophisticated mix of cloned legitimate projects, realistic documentation, and fake developer profiles to appear trustworthy.
Visitors are guided to download ZIP archives from GitHub Releases, a channel often perceived as more reliable. Approximately 200 of these repositories have recorded more than 14 million downloads, demonstrating the campaign’s significant reach. In roughly 800 cases the repositories masquerade as AI-related utilities, specifically presented as Skills or MCP (Model Context Protocol) servers.
This approach enables the AgentBaiting technique, in which attackers do not need to send direct links; instead, they rely on AI agents searching for free skills or MCP servers and subsequently following installation instructions that execute malicious code. Internal tests have shown that systems including Anthropic Claude Code, Google Gemini, and OpenAI ChatGPT can surface malicious repositories during discovery.
The infection chain begins with the downloaded ZIP, which triggers a staged payload executed through LuaJIT and culminating in an obfuscated Lua script that installs SmartLoader. The loader maintains persistence on Windows via scheduled tasks and resolves its command-and-control infrastructure dynamically using a blockchain-based dead drop referencing a smart contract on Polygon.
Exposure is further amplified by more than 600 listings appearing on public directories such as LobeHub, Glama, MCP.so, and MCP Market. Organizations are recommended to avoid executing unverified ZIP files or scripts, maintain internal catalogs of approved AI components, apply application control policies, and monitor for LuaJIT execution and anomalous network activity including direct IP connections or Polygon RPC endpoints.
Related articles
Linux Foundation Report Reveals Why Companies Fork Open Source Projects and Maintain Internal Patches
A new Linux Foundation Research study of 567 IT professionals shows that organizations actively modify open source components rather than using them unchanged. While 72% contribute back to projects in some form, many maintain internal forks due to missing features, integration needs, security timelines, and regulatory requirements. The average organization supports 86 internal forks, consuming over 5,000 hours per release cycle. The largest gaps between business-critical technologies and actual contributions appear in programming languages and databases. The findings highlight growing supply-chain risks when internal branches diverge from upstream projects without proper tracking of patches and commits.
Where Secrets Really End Up in Docker Images: Testing 8 Common Methods
A detailed analysis of eight different approaches for handling secrets during Docker image builds reveals that most methods leave sensitive data exposed in layers, configuration files, or build history. Experiments conducted on Ubuntu 24.04.1 LTS with Docker Engine 29.1.3 and BuildKit v0.26.2 showed that simply using RUN rm after COPY or overwriting files fails to remove secrets from immutable layers. Environment variables via ENV and build arguments via ARG both persist in image metadata and history. Only BuildKit Secrets with --mount=type=secret and multi-stage builds that avoid copying secrets into the final stage successfully prevent leakage. The study demonstrates that secrets can be extracted from saved images without running any containers. Developers are advised to adopt these two secure patterns to protect credentials in container supply chains.
Mozilla Revokes GPG Signing Key After Accidental Upload to Private GitHub Repository
Mozilla has replaced the GPG key used to sign certain Firefox and Thunderbird builds following an accidental exposure of the unencrypted secret key in a private GitHub repository. The key was intended for signing Linux archives, RPM packages, and checksum files, raising theoretical risks of supply-chain attacks through forged installers. Company audits found no evidence of external misuse, as repository access was limited to a small group of employees who already held legitimate access to the key. Most users require no action, though those manually verifying GPG signatures must import the new key along with revocation data for the old one. Linux administrators installing Firefox via RPM packages on distributions such as Fedora, RHEL, Rocky Linux, AlmaLinux, openSUSE, and SUSE may need to manually update the key to avoid installation failures. Thunderbird users are unaffected by the RPM issue since no official RPM packages are released for the email client. The new key remains valid until August 5, 2028, with public details available in updated KEY files and on keys.openpgp.org.
ChainDrop Malware Infects Over 1,300 npm Packages in Record Supply Chain Poisoning Campaign
Security researchers have uncovered a massive supply chain attack involving the ChainDrop malware that compromised more than 1,300 npm packages with a combined 2 billion monthly downloads. The malicious code silently steals npm tokens, GitHub credentials, and SSH keys before using stolen tokens to infect additional packages in a self-propagating loop. In a parallel incident, the Open VSX marketplace removed 77 malicious extensions that impersonated popular developer tools and harvested host and repository data. Attackers have also begun exploiting AI coding assistants through a technique called HalluSquatting, registering packages that match hallucinated names suggested by tools such as GitHub Copilot and Claude Code. The incidents highlight how modern supply chain threats now extend beyond direct dependencies to include AI-generated recommendations and automated publishing pipelines. Experts recommend strict lockfile usage, minimal token permissions, and manual verification of any package suggested by AI assistants.