FakeGit Campaign Leverages 7,600 Malicious GitHub Repos to Distribute SmartLoader Malware
What Happened — Researchers uncovered a coordinated operation, dubbed FakeGit, that created more than 7,600 GitHub repositories masquerading as AI skills, CI/CD tools, and popular consumer apps. The repos host ZIP archives containing a Lua payload that installs the SmartLoader loader, which then pulls the StealC information‑stealer via a Polygon smart‑contract C2. Over 14 million downloads have been recorded since the campaign began.
Why It Matters for Compliance & Audit Readiness
- The attack exploits the open‑source supply chain, a scenario SOC 2 controls (CC6.1 Risk Assessment, CC7.1 Vendor Management) are designed to monitor and document.
- Continuous evidence of third‑party code vetting satisfies audit requirements and provides a defensible trail if malicious components are discovered.
- Verisq’s Vendor Risk capability automates monitoring of public code repositories, turning raw download counts into audit‑ready proof of due diligence.
Who Is Affected – Software developers, DevOps teams, and enterprises that integrate open‑source or AI‑enhanced tooling across technology and SaaS sectors.
Recommended Actions –
- Adopt a formal open‑source component policy that includes automated scanning of repository metadata and code.
- Integrate continuous monitoring of GitHub (and similar platforms) into your SOC 2 evidence‑collection workflow.
- Require third‑party risk assessments for any external AI skill or plugin before adoption.
Source: BleepingComputer
Technical Notes – The malicious ZIP files contain Lua payloads that trigger SmartLoader, which establishes persistence via scheduled tasks, resolves its C2 address through a Polygon smart contract, and downloads encrypted stages from GitHub before delivering the StealC stealer. The campaign leverages “agentbaiting,” a technique that targets AI agents (e.g., ChatGPT, Gemini, Claude) that surface code suggestions. Source: same as above