The resurgence of the FakeGit malware campaign demonstrates how cybercriminals are increasingly exploiting the reputation of legitimate developer platforms to distribute malware at scale. Researchers have identified 17,610 malicious GitHub repositories, with more than 13,000 repositories redirected toward malicious payloads within just 34 hours. The campaign uses convincing project descriptions and download links to distribute SmartLoader, which subsequently delivers information-stealing malware such as StealC.

What makes this campaign particularly concerning is not merely the number of malicious repositories, but the attackers' ability to reuse existing infrastructure. Rather than continuously creating new repositories, the operators can modify README files, redirect download links and use alternative payload locations to keep their campaign operational. This makes conventional takedown efforts and static URL blocklists less effective.

The findings also expose a fundamental challenge for enterprise cybersecurity. GitHub is widely trusted and essential to software development, making it impractical for most organizations to block the entire platform. Attackers exploit this trust by embedding malicious downloads within otherwise legitimate-looking repositories. The challenge is therefore not simply identifying malicious domains, but distinguishing harmful content and behavior within trusted services.

The implications extend beyond individual developer workstations. A successful infostealer infection could expose credentials, access tokens and development environments, potentially creating opportunities for further compromise across enterprise systems and software supply chains.

Organizations need a layered security approach combining malicious file detection, content-aware URL filtering, endpoint protection, application control and behavioral monitoring. Equally important is verifying software sources and treating unexpected executable downloads from GitHub with caution.

The broader lesson is clear: a trusted platform does not automatically make every file, repository or download trustworthy. Cybersecurity controls must evaluate the actual content and behavior of what users access, rather than relying exclusively on the reputation of the hosting domain.

More than 17,000 fake repositories on GitHub are distributing the SmartLoader malware after the FakeGit campaign reactivated earlier this month to push the StealC infostealer. [...]

Source: FakeGit malware campaign returns with 17,610 malicious GitHub repos via Bleeping Computer — published 08 Oct 2026.