Severity
High
Analysis Summary
The FakeGit campaign has reactivated on October 4, 2026, distributing SmartLoader malware through 17,610 fake GitHub repositories. According to researchers, the campaign uses these repositories to deliver SmartLoader, a malware loader capable of deploying additional malicious payloads, including the StealC information-stealing malware. The operation previously gained attention in July, when researchers identified 7,600 malicious repositories, including some disguised as AI skills and Model Context Protocol (MCP) servers.
The attackers primarily use disposable accounts, although researchers identified at least 700 accounts that appear to belong to legitimate developers. The repositories contain convincing README files with download buttons directing users to ZIP archives that install SmartLoader. The campaign rapidly expanded during its latest resurgence, adding more than 13,000 repositories within 34 hours and reaching a peak rate of 2,999 repositories per hour. Researchers found that 97% of sampled commits modified only README files, while 88% redirected download buttons to SmartLoader-hosting ZIP archives.
FakeGit has continued operating because existing repositories remain available even when malicious payloads or download URLs are blocked. Researchers reported that 71% of the malicious repositories were absent from URLhaus before its investigation. Attackers can redirect download links to backup archives hosted in repository forks, older files, release assets, issue attachments, and separate hosting repositories, making individual takedowns ineffective.
The campaign poses significant risks to developers and users downloading software, AI skills, or MCP servers from unverified sources. Successful execution may result in malware infections, information theft, and potential compromise of GitHub accounts and development environments.
Users should verify repository ownership and download software, AI skills, and MCP servers only from official registries or trusted vendor repositories. Security teams should monitor suspicious GitHub downloads, inspect unexpected ZIP archives, and investigate endpoints for SmartLoader activity. If execution is suspected, affected users should treat the incident as a potential GitHub account compromise, revoke active sessions and access tokens, and transition to passkeys to strengthen account security.
Impact
- Information Theft
- Unauthorized Access
Indicators of Compromise
IP
194.48.248.94
185.10.68.110
MD5
- fe67c54a6387db6bf31f73ea6d695c12
- e482d9f2f0cdcd1b388e10c105f66502
- ee7bb4c0c17a6e4ca7d625ff7c42d6e5
- 4c1b43139162ad777dd50213550885fb
- 5e7c7a54a11f781b84fc779cd3b4d19d
- c91a15572dd68836ed52ebc8b1d00694
SHA-256
- 8cede35b80b1deaf732c2b178d908f91b3e7a0c114d06dfae9075b8a9bf78b8f
- f9436ccb986760ca379d6cd2f00726e032a1d9c250a9bd261d40d98b914e7ef9
- 73f3c4ae76c086f962a06d790be6cc104a47c9d1bfcaebd12eebb3455b090660
- 18750cfa651271dc086f6806ac01c3c9d621e949b6127ff199a174cb774d8064
- 33bba47346c03968977688bddbdd245210c06fb7686b4dfc78789c70e2a95219
- 77e46759791c9230afc29baeb6cb048a9a05196db1a48705dd94aa2e74b93e0e
SHA1
- 97134dbb856b11be3b018508e980f58622bc5350
- 5b7f6e5802ffd5895185da01d8a24fa16eba186b
- 704ab265d16b56afc1bcdcb1079153ddf8d2a1ab
- ab0b0f55bcc557b69c941444f8aca2b1eca99afa
- f0c08a40015fbc270c5d1c123380fd90f443decb
- adfda4aebcd09124277d227f49a7ebecf6fc75fc
Remediation
- Block known malicious URLs, file hashes, and domains associated with the FakeGit campaign and SmartLoader payloads.
- Monitor GitHub downloads and developer endpoints for suspicious ZIP archives, payload execution, and unusual child-process activity.
- Verify repository ownership and download AI skills, MCP servers, and development tools exclusively from official registries or trusted vendor repositories.
- Inspect downloaded archives using antivirus, EDR, and sandboxing solutions before execution.
- Implement application control policies to prevent unauthorized execution of binaries and scripts from downloaded archives.
- Hunt for SmartLoader indicators of compromise (IOCs) across endpoints, network telemetry, and security logs.
- Monitor GitHub repositories for suspicious README modifications, misleading download links, and unexpected changes to repository content.
- Investigate suspected infections for secondary malware, credential theft, and unauthorized access to development environments.
- Revoke active GitHub sessions and access tokens, rotate potentially exposed credentials, and review account activity if compromise is suspected.
- Enforce phishing-resistant multifactor authentication (MFA), preferably passkeys, for developer accounts.
- Isolate affected endpoints from the network when malicious execution is confirmed and initiate incident response procedures.
- Review and remove malicious archives from repository forks, release assets, issue attachments, and other identified hosting locations where applicable.