FakeGit malware campaign returns with 17,610 malicious GitHub repos

The FakeGit campaign involves a large-scale operation distributing SmartLoader malware via fake GitHub repositories. After reactivating in early October 2026, the campaign expanded to 17,610 malicious repositories, many of which were repurposed from an existing fleet. The repositories typically contain README instructions with download buttons linking to ZIP archives that install SmartLoader, which subsequently delivers other malware such as the StealC infostealer. The campaign uses a mix of throwaway and legitimate developer accounts to evade detection. Removal efforts are hindered by the presence of backup copies in forks, older files, release assets, and issue attachments, allowing attackers to quickly redirect download links. Researchers recommend verifying repository ownership and using official registries or vendor repositories for installing software components.

The campaign enables widespread distribution of SmartLoader malware and the StealC infostealer through fake GitHub repositories, potentially compromising users who download and execute the malicious payloads. The persistence and scale of the campaign make it difficult to fully remove the threat from GitHub, increasing the risk of infection. Compromise may lead to information theft and further malware deployment. Users of GitHub and related software supply chains are at risk if they rely on unverified repositories.

Users should verify the ownership of GitHub repositories before downloading or executing any code, especially for AI skills or MCP servers. Only use official registries or vendor repositories for software installations. If SmartLoader execution is suspected, treat it as a potential GitHub account compromise by revoking active sessions and access tokens and transitioning to passkeys. Due to the campaign's persistence and use of backup copies, removal of individual repositories or files is ineffective. Continuous vigilance and reliance on trusted sources are essential.