Malicious GitHub Repos Weaponize AI Hype to Deliver SmartLoader Malware
The FakeGit campaign exploits developer trust in GitHub and the AI ecosystem by seeding thousands of convincing fake repositories that mimic legitimate AI tools, tricking developers and automated AI agents into downloading malware. The use of 'agentbaiting' represents an evolution in supply chain attacks, deliberately targeting the pipeline between AI tooling and developer workflows. With over 14 million downloads, this demonstrates how attackers can achieve massive reach by abusing trusted, high-visibility platforms. Organizations that allow developers to freely import third-party repositories without vetting expose themselves to credential theft and persistent compromise via StealC. The scale of this campaign underscores that popularity metrics like stars and download counts are not reliable proxies for trustworthiness.
Tactical Insight
Immediate actions
- Audit all recently pulled GitHub repositories against known malicious hashes and the FakeGit/Water Kurita indicators of compromise.
- Block or quarantine execution of newly downloaded packages from unverified GitHub sources until a security review is completed.
- Alert developers to verify repository authenticity (owner identity, commit history, linked website) before use.
Long-term improvements
- Enforce a software composition analysis (SCA) gate in CI/CD pipelines that scans all third-party dependencies before build or deployment.
- Maintain an approved internal registry of vetted open-source packages and prohibit direct pulls from public repositories in production workflows.
- Implement developer training specifically covering supply chain social engineering, including AI tool impersonation tactics.
Detection measures
- Deploy endpoint detection rules to flag behaviors associated with SmartLoader and StealC (e.g., unusual process injection, credential store access).
- Monitor outbound network traffic for connections to known C2 infrastructure linked to the FakeGit campaign.
- Enable GitHub audit logging and alert on bulk repository cloning or anomalous download activity from organizational accounts.