{"id":719,"date":"2026-07-27T16:55:44","date_gmt":"2026-07-27T11:25:44","guid":{"rendered":"https:\/\/www.hexnode.com\/threat-watch\/?p=719"},"modified":"2026-08-18T17:00:10","modified_gmt":"2026-08-18T11:30:10","slug":"fakegit-malware-github-repositories-smartloader-stealc","status":"publish","type":"post","link":"https:\/\/www.hexnode.com\/threat-watch\/fakegit-malware-github-repositories-smartloader-stealc\/","title":{"rendered":"FakeGit Malware: How 7,600 Fake GitHub Repositories Spread SmartLoader and StealC"},"content":{"rendered":"

What Is FakeGit Malware?<\/h2>\n

FakeGit malware is a large-scale software supply chain campaign that exploits developers’ trust in GitHub and open-source software. Instead of targeting software vulnerabilities, attackers create convincing fake GitHub repositories that mimic legitimate projects, developer tools, and AI integrations to trick developers or AI coding assistants into downloading and running malicious code.<\/p>\n

According to Island’s research, the campaign delivers SmartLoader, which installs additional malware, including the StealC information stealer.<\/p>\n

The campaign highlights how threat actors are increasingly abusing trusted developer platforms and AI-assisted software discovery to distribute malware.<\/p>\n

How the FakeGit Malware Campaign Works<\/h2>\n

Researchers identified approximately 7,600 malicious GitHub repositories spread across nearly 6,600 disposable GitHub accounts<\/a>.<\/p>\n

Many of these repositories impersonate well-known open-source projects and developer tools, including Gmail, WhatsApp, Databricks, Jenkins, and Docker.<\/p>\n

To appear legitimate, attackers use convincing README files, fabricated GitHub star counts, copied project descriptions, and stolen or borrowed developer identities.<\/p>\n

Some repositories are fully fake, while others closely replicate real projects, making them difficult to distinguish from authentic software.<\/p>\n

The campaign also abuses GitHub Releases to distribute malware at scale:<\/p>\n