FakeGit Malware Campaign Returns with 17,610 Malicious GitHub Repositories Distributing SmartLoader
What Happened — Researchers at Apiiro reported that on October 4 the FakeGit operator re‑activated a supply‑chain campaign, repurposing 17,610 GitHub repositories to host a ZIP payload that installs the SmartLoader infostealer (also used to deliver the StealC data‑stealer). 97 % of the repos only modify the README to point to the malicious download, and 71 % of the URLs were absent from public blocklists, allowing the fleet to persist despite takedown attempts.
Why It Matters for Trust & Control Assurance
- Continuous monitoring of third‑party code repositories satisfies control objectives for software‑supply‑chain risk management.
- Collecting verifiable evidence of repository vetting (owner verification, provenance checks) provides a defensible audit trail.
- Mapping these activities to a control‑assurance framework demonstrates due‑diligence to regulators and partners.
Who Is Affected — Software developers, AI‑skill providers, and any organization that consumes open‑source components or code from public repositories.
Recommended Actions
- Deploy automated scanning of all external repositories for malicious artifacts.
- Enforce code‑signing or provenance verification before integrating third‑party code.
- Maintain an up‑to‑date Software Bill of Materials (SBOM) and document validation steps for audit readiness. Source: BleepingComputer
Technical Notes
- Payload: SmartLoader infostealer (delivers StealC).
- Attack vector: Malicious ZIP files linked from README pages; also hosted in forks, release assets, and issue attachments.
- No new repositories were created; existing repos were simply re‑aimed. Source: BleepingComputer