CyberNew CyberNew
Ransomware & Malware BleepingComputer 1 week ago

FakeGit malware campaign returns with 17,610 malicious GitHub repos

CN
CyberNew Threat Research Desk
• Original Reporting: BleepingComputer
CyberNew Threat Intel Assessment
Assessed Severity: HIGH
Impacted Surface
Enterprise Perimeter & Network Defense
Intelligence Sector
Ransomware & Malware

Analyst Takeaway

"More than 17,000 fake repositories on GitHub are distributing the SmartLoader malware after the FakeGit campaign reactivated earlier this month to push the StealC infostealer. The operator uses mostly throwaway accounts, but researchers identified at least 700 accounts that appear to belong to legitimate developers. The malicious repositories use convincing README instructions with a download..."

Recommended Defense & Mitigation

  • Access Review: Audit administrative roles, enforce phishing-resistant MFA, and review privilege escalations.
  • Credential Rotation: Rotate high-privilege service credentials and tokens associated with impacted services.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)

FakeGit malware campaign returns with 17,610 malicious GitHub repos

More than 17,000 fake repositories on GitHub are distributing the SmartLoader malware after the FakeGit campaign reactivated earlier this month to push the StealC infostealer.

The operator uses mostly throwaway accounts, but researchers identified at least 700 accounts that appear to belong to legitimate developers.

The malicious repositories use convincing README instructions with a download button pointing to a ZIP archive containing the initial payload, SmartLoader, that is used to distribute other malware. 

While similar activity with various payloads has been observed since at least January, the FakeGit term was associated with this operation in July, when researchers at enterprise browser platform Island published a report on 7,600 fake GitHub repositories pushing the SmartLoader malware.

Save your seat

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from BleepingComputer.

Primary Advisory →