FakeGit Campaign Reactivates on GitHub, Distributing SmartLoader Malware via 17,000 Repos

The FakeGit malware campaign has reactivated, utilizing more than 17,600 fake repositories on GitHub to distribute malicious software to developers. According to a report by BleepingComputer, the campaign returned earlier this month with the specific intent of pushing the StealC infostealer to users.

The resurgence of this campaign involves a massive scale of deception, with over 17,610 malicious repositories identified on the platform. These fake repositories are designed to mimic legitimate code projects, tricking developers into downloading harmful payloads. The primary delivery mechanism in this latest wave is the SmartLoader malware, which serves as an initial access tool to install further malicious components on compromised systems.

Campaign Mechanics and Malware Components

The FakeGit campaign operates by creating repositories that appear to be legitimate open-source projects or common libraries. Developers who clone or download these repositories inadvertently execute the SmartLoader malware. Once SmartLoader is installed, it acts as a loader for subsequent threats.

In this recent activation, the campaign has shifted its focus to distributing the StealC infostealer. StealC is designed to harvest sensitive information from infected systems, including credentials, browser data, and other personal details. The use of SmartLoader as a precursor allows the attackers to bypass initial security checks before deploying the more specialized infostealer.

According to BleepingComputer, the reactivation of the campaign highlights the persistent threat posed by supply chain attacks on code hosting platforms. The sheer number of compromised repositories—exceeding 17,000—indicates an automated or highly coordinated effort to flood the platform with malicious content.

Who Is Affected

Developers and security professionals who monitor or clone repositories on GitHub are at risk. The campaign specifically targets users who may not thoroughly vet the authenticity of repositories before integrating them into their workflows.

Organizations that rely on third-party code from GitHub without rigorous security scanning are particularly vulnerable. The widespread nature of the fake repositories means that the threat is not limited to a specific niche or programming language, but rather targets the general developer community on the platform.

What should you do?

No confirmed patch or fix has been released by GitHub to address this specific campaign, as the issue stems from user-generated content rather than a platform vulnerability. Security professionals should exercise extreme caution when cloning or downloading repositories from GitHub.

It is recommended to verify the authenticity of repositories by checking the author’s profile, the number of stars, and the history of commits. Security teams should implement strict policies for reviewing third-party code before it is integrated into development environments. Additionally, using automated security scanning tools to detect known malware signatures like SmartLoader and StealC can help identify compromised dependencies early.

Frequently asked questions

How many fake repositories were involved in the FakeGit campaign?

More than 17,610 malicious repositories were identified distributing malware on GitHub.

What malware is the FakeGit campaign currently distributing?

The campaign is distributing SmartLoader malware and the StealC infostealer.

When did the FakeGit campaign reactivate?

The campaign reactivated earlier this month.