GajShield Threat Advisory — FakeGit Campaign: SmartLoader ZIP Archives Distributed via Fake GitHub Repositories

Severity: High | Priority: 2

This GajAV update adds detection for malicious ZIP archives from FakeGit, a large-scale malware campaign that uses fake GitHub repositories to spread the SmartLoader downloader and the StealC information stealer. Researchers at Island found the operators had created about 7,600 malicious repositories using roughly 6,600 accounts. Public release assets recorded more than 14 million download events.

The repositories copy real open-source projects or advertise popular tools, such as utilities for Gmail, WhatsApp, Databricks, Jenkins and Docker, and the README tells users to download a ZIP archive. More than 800 repositories pose as AI-agent skills and MCP servers. This targets developers and also AI coding assistants that might find and recommend these repositories.

The ZIP archive contains a short batch file that starts a LuaJIT interpreter and runs a heavily obfuscated Lua script, SmartLoader. SmartLoader then:

• persists through a scheduled task;
• reads its command-and-control address from a smart contract on the Polygon blockchain, which makes the C2 address hard to take down;
• downloads further encrypted components, which leads to theft of browser passwords, cookies, cryptocurrency wallets and other data.

The new signatures identify known FakeGit ZIP archives by file hash, so GajAV can block them when they are downloaded or written to disk on hosts in your network.

If GajAV detects one of these archives, find out whether the user extracted it and ran anything from it. If the archive was only downloaded and quarantined, delete it and tell the user which repository it came from. If anything from the archive was run, treat the host as compromised:

• Isolate the host.
• Look for scheduled tasks that launch LuaJIT or Lua scripts, and for LuaJIT executables or .lua files in user-writable folders.
• Because StealC steals browser data, reset every password saved in the browser on that host and revoke active sessions, especially for source-code, cloud and CI/CD accounts.
• Move any cryptocurrency held in wallets on the host to new wallets.
• Check whether developer tokens or API keys stored on the machine have been used.