FakeGit GitHub Repository Campaign (SmartLoader/StealC Distribution)

Technical Analysis

The FakeGit campaign leverages GitHub's trust as a code hosting platform to distribute thousands of malicious repositories that masquerade as legitimate open-source tools, cracked software, or utilities. Victims who clone or download these repositories execute SmartLoader, a malware loader that subsequently deploys StealC, an information-stealing trojan capable of harvesting browser credentials, cryptocurrency wallets, session tokens, and system data. The scale (7,600 repos, 14M+ downloads) suggests automated repository generation and possible abuse of GitHub search/SEO ranking to maximize visibility. Because developers and AI coding agents frequently search GitHub for libraries, snippets, and tools to auto-install or execute as part of automated workflows, this campaign poses a direct risk to AI agent pipelines that autonomously fetch and run code from GitHub without human review, potentially leading to credential theft (including API keys used by agents) and downstream compromise of agent-integrated systems.

Affected Systems

Developer workstations, CI/CD pipelines, and any systems (including AI coding agents or automated build tools) that clone, download, or execute code from unverified GitHub repositories running Windows (primary target for SmartLoader/StealC payloads)

Indicators of Compromise

• GitHub repositories associated with 'FakeGit' campaign (specific repo names/URLs not disclosed in source)
• SmartLoader malware payloads
• StealC information-stealer binaries
• Associated C2 domains/IPs not specified in available reporting

Remediation Steps

1. 1

   Audit repository sources

   Review and restrict automated or manual downloads of code from unverified GitHub repositories, especially those with suspicious naming conventions or low reputation scores.

2. 2

   Implement code scanning before execution

   Use static and dynamic analysis tools to scan cloned repositories for malicious scripts, obfuscated code, or known SmartLoader/StealC signatures prior to execution or integration.

3. 3

   Restrict AI agent and automation code-fetching

   Configure AI coding agents, RAG pipelines, and automated build systems to require human approval before cloning, installing, or executing code from external GitHub repositories.

4. 4

   Deploy endpoint detection

   Ensure EDR/AV solutions have updated signatures for SmartLoader and StealC malware families to detect and block execution.

5. 5

   Rotate exposed credentials

   If StealC infection is suspected, rotate all browser-stored credentials, API keys, cryptocurrency wallet keys, and session tokens on affected systems.

6. 6

   Monitor for GitHub abuse patterns

   Implement organizational policies to flag repositories with unusually high download counts relative to age, minimal commit history, or generic/copycat naming.