Fake GitHub 'EQVita' Homebrew Repo Delivers SmartLoader and Lumma Stealer to the Retro Gaming / PlayStation Vita Modding Community

Key facts for SmartLoader EQVita GitHub lure

Detection coverage for SmartLoader EQVita GitHub lure

As of 2026-06-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0849 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Lumma C2 — Edge Remote-Debugging Cookie Scrape + Beacon to Hardcoded IP (C2 / Exfiltration)

Detects the Lumma Stealer collection and C2 stage: Microsoft Edge launched with --remote-debugging-port=9222 by a non-browser parent (live browser-session/cookie scraping via Chrome DevTools Protocol), and outbound beacons to the campaign C2 IP 85.137.52.21 or domain pasteflawwed.world following interpreter launch. Covers credential/cookie theft, web-protocol C2, ingress tool transfer of the renamed search.exe payload, and exfiltration over the C2 channel.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1539, T1555.003, T1071.001, T1105, T1041
• Data sources: sysmon, microsoft_defender_for_endpoint, zeek_network, firewall_proxy
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=1 OR EventCode=3)
| eval edge_debug=if(EventCode=1 AND match(lower(Image),"msedge\.exe$|chrome\.exe$") AND match(CommandLine,"--remote-debugging-port=9222") AND NOT match(lower(ParentImage),"msedge\.exe$|explorer\.exe$|chrome\.exe$"),1,0)
| eval c2_beacon=if(EventCode=3 AND (DestinationIp="85.137.52.21" OR match(lower(DestinationHostname),"pasteflawwed\.world$")),1,0)
| where edge_debug=1 OR c2_beacon=1
| stats count sum(edge_debug) as debug_events sum(c2_beacon) as c2_events values(CommandLine) as cmdlines values(ParentImage) as parents values(DestinationIp) as dest_ips values(DestinationHostname) as dest_hosts min(_time) as firstTime max(_time) as lastTime by host, User
| convert ctime(firstTime) ctime(lastTime)
| where debug_events>0 OR c2_events>0
| sort - lastTime

Microsoft KQL

let edge_debug = DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName in~ ("msedge.exe","chrome.exe")
    | where ProcessCommandLine has "--remote-debugging-port=9222"
    | where InitiatingProcessFileName !in~ ("msedge.exe","chrome.exe","explorer.exe")
    | project Timestamp, DeviceName, AccountName, Signal="edge_remote_debug", Detail=ProcessCommandLine, Parent=InitiatingProcessFileName;
let c2 = DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where RemoteIP == "85.137.52.21" or RemoteUrl has "pasteflawwed.world"
    | project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, Signal="c2_beacon", Detail=strcat(RemoteIP," ",RemoteUrl), Parent=InitiatingProcessFileName;
union edge_debug, c2
| order by Timestamp desc

Sigma

title: Lumma C2 — Edge Remote-Debugging Cookie Scrape and Beacon to EQVita Campaign Infrastructure
id: 8c3f4a62-ae5d-4b43-c2d3-3e4f5a6b7c82
status: experimental
description: Detects Microsoft Edge launched with --remote-debugging-port=9222 by a non-browser parent (live cookie/session scraping) and outbound C2 to EQVita campaign infrastructure, the Lumma Stealer collection/C2 stage (TL-2026-0849).
references:
    - https://www.malwarebytes.com/blog/threat-intel/2026/06/retro-gaming-fans-are-the-new-target-for-fake-github-malware
    - https://www.huntress.com/threat-library/malware/lumma-stealer
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-06-18
tags:
    - attack.credential_access
    - attack.command_and_control
    - attack.exfiltration
    - attack.t1539
    - attack.t1555.003
    - attack.t1071.001
    - attack.t1105
    - attack.t1041
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith: '\msedge.exe'
        CommandLine|contains: '--remote-debugging-port=9222'
    filter_parent:
        ParentImage|endswith:
            - '\msedge.exe'
            - '\explorer.exe'
    condition: selection and not filter_parent
falsepositives:
    - Developers or automated browser tests (Selenium/Puppeteer/Playwright) legitimately using remote-debugging
level: high

Known false positives:

• Browser-automation frameworks (Selenium, Puppeteer, Playwright) or developers legitimately using --remote-debugging-port
• Security tooling that proxies/inspects browser sessions

Tuning notes: Allowlist known automation hosts/service accounts for the remote-debugging branch. Keep the IOC list (85.137.52.21, pasteflawwed.world) refreshed from current threat intel and treat it as exact-match high-confidence. Escalate when the Edge remote-debug event and a C2 beacon occur on the same host within minutes of a SPL-001 LuaJIT hit.

• 🔒 SmartLoader Package Pattern — Bundled Interpreter Spawned by [indicator] (Exploitation) · unlock with TL Creds
• 🔒 SmartLoader In-Memory Deobfuscation + Geolocation/Host Recon Following LuaJIT Launch (Post-Exploitation) · unlock with TL Creds
• 🔒 Lumma C2 / Ingress Tool Transfer — Beacon to [indicator] and [indicator] Retrieval (C2 / Lateral) · unlock with TL Creds
• 🔒 SmartLoader LuaJIT .txt Loader From User-Writable Path — Sigma (Exploitation) · unlock with TL Creds
• 🔒 SmartLoader HKCU Run-Key Persistence To User-Writable Launcher — Sigma (Post-Exploitation) · unlock with TL Creds
• 🔒 Lumma Edge Remote-Debugging Cookie Scrape by Non-Browser Parent — Sigma (C2 / Lateral) · unlock with TL Creds
• 🔒 SmartLoader LuaJIT LOLBin — Signed Interpreter Executing .txt Loader From User-Writable Path (Exploitation) · unlock with TL Creds
• 🔒 SmartLoader Post-Exploitation — Findstr AV Reconnaissance + HKCU Run-Key Persistence (Post-Exploitation) · unlock with TL Creds

Indicators of compromise for SmartLoader EQVita GitHub lure

As of 2026-06-18, Threadlinqs Intelligence tracks 21 indicators of compromise for TL-2026-0849.

Sample indicators (3 of 21)

• IP address: 85.137.52[.]21
• Domain: voistace[.]github[.]io
• Domain: pasteflawwed[.]world

Defanged, TLP:CLEAR. Full set of 21 indicators: unlock with TL Creds.

How SmartLoader EQVita GitHub lure works

Malwarebytes Threat Intelligence reported on June 18, 2026 that operators behind the broader SmartLoader/Lumma Stealer fake-GitHub ecosystem (overlapping with the actor cluster Trend Micro tracks as Water Kurita and the Lumma developer Microsoft tracks as Storm-2477) have pivoted to social-engineering the retro gaming and console homebrew/modding community. The threat actor stood up a counterfeit GitHub repository at github.com/Voistace/EQVita with a paired GitHub Pages site at voistace.github.io, impersonating EQVita, a legitimate free equalizer/audio utility for the PlayStation Vita homebrew scene. To appear authentic while evading takedown, the fake repo is published as version 1.3 while the genuine project is at version 1.10.

The delivered archive, EQ_Vita_v1.3.zip, follows the signature SmartLoader packaging pattern: a launcher batch file (Launch.bat), a legitimately-signed LuaJIT interpreter (luajit.exe) accompanied by the lua51.dll runtime, and an obfuscated Lua script disguised with a benign .txt extension (x64.txt). Because the EXE and DLL are themselves clean, static AV and reputation checks frequently pass. Launch.bat invokes luajit.exe with x64.txt as an argument; the Lua loader deobfuscates itself in memory, performs geolocation/host reconnaissance, and establishes command-and-control over 'scrambled' (obfuscated/encoded) URLs to attacker infrastructure including the C2 IP 85.137.52.21.

Consistent with the wider Water Kurita campaign, the SmartLoader stage retrieves the Lumma Stealer payload (commonly renamed search.exe) from GitHub-hosted releases, stages an AutoIt interpreter and script (observed elsewhere via Excel/%TEMP% staging and an interpreter masquerading as Research.com), performs findstr-based reconnaissance for endpoint security products (Avast, Norton, Sophos), and launches Microsoft Edge with --remote-debugging-port=9222 to programmatically scrape live browser session data. Lumma Stealer (LummaC2), distributed under a malware-as-a-service model, then exfiltrates Chromium/Gecko browser saved passwords, cookies, autofill data, MFA/login codes, and cryptocurrency wallet artifacts (e.g., MetaMask, Electrum, Exodus) to C2 (campaign infrastructure includes pasteflawwed.world). The campaign demonstrates that any retro platform with an active modding scene is now a viable targeting surface for infostealer delivery.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1564 Hide Artifacts

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer

Discovery

T1082 System Information Discovery; T1518 Software Discovery; T1614 System Location Discovery

Credential Access

T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores

Persistence

T1547 Boot or Logon Autostart Execution

Initial Access

T1566 Phishing

Resource Development

T1583 Acquire Infrastructure; T1608 Stage Capabilities

Remediation for SmartLoader EQVita GitHub lure

Immediate actions

• Block C2 IP 85.137.52.21 and domain pasteflawwed.world at the perimeter/DNS layer
• Block/monitor the malicious distribution hosts github.com/Voistace/EQVita and voistace.github.io
• Hunt for luajit.exe / lua51.dll executing from user-writable paths (Downloads, %TEMP%, Desktop) with a .txt script argument
• Hunt for msedge.exe launched with --remote-debugging-port=9222 by a non-browser parent process
• Quarantine any EQ_Vita_v1.3.zip, x64.txt, Launch.bat, or search.exe artifacts and force-reset credentials/wallet seeds on affected hosts

Workarounds

• Only download homebrew tools from verified official project sources and confirm version numbers (genuine EQVita is v1.10, not v1.3)
• Disable browser remote-debugging where not required and monitor port 9222 binds

Longer-term hardening

• Deploy EDR with behavioral detection for LOLBin abuse (LuaJIT loader pattern) and browser remote-debugging scraping
• Restrict execution of unsigned/interpreter binaries from user-writable directories via WDAC/AppLocker
• Enforce application allowlisting and block AutoIt interpreters outside approved use
• Security-awareness training for staff who use homebrew/modding/gaming tools on managed devices

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: 10; 11
• Chromium / Mozilla — Web browsers (saved credentials, cookies, autofill)
  Vulnerable versions: Chromium-based; Gecko-based
• Cryptocurrency wallets — MetaMask / Electrum / Exodus and similar
  Vulnerable versions: browser-extension and desktop wallets

Timeline of SmartLoader EQVita GitHub lure

• 2022-08-01 locked-ioc-11 (LummaC2), a C-language infostealer, is first observed advertised on Russian-speaking underground forums and sold under a malware-as-a-service model (developer later tracked by Microsoft as Storm-2477).
• 2025-03-11 Trend Micro's Threat Hunting team publishes its report on the Water Kurita campaign, documenting AI-generated fake GitHub repositories that deploy locked-ioc-14 to deliver locked-ioc-11, disguising malware as gaming cheats, cracked software, and system tools.
• 2025-03-16 Start of the window during which Microsoft identifies over 394,000 Windows computers worldwide infected by locked-ioc-11 (March 16 - May 16, 2025).
• 2025-05-21 Microsoft's Digital Crimes Unit, the U.S. DOJ, and global partners disrupt locked-ioc-11 infrastructure, seizing/blocking approximately 2,300 malicious domains along with the malware's command structure and sales marketplaces.
• 2025-06-01 Despite the takedown, Lumma operators rapidly restore command-and-control infrastructure and resume distribution, underscoring the resilience of the MaaS platform.
• 2026-06-18 locked-ioc-14 stage fetches and executes locked-ioc-11 to harvest browser passwords, cookies, login/MFA codes, and cryptocurrency wallets.
• 2026-06-18 locked-ioc-15 invokes legitimate locked-ioc-16 to run the disguised obfuscated Lua script locked-ioc-20, which performs geolocation checks and beacons to C2 locked-ioc-12 via an obfuscated web address.
• 2026-06-18 Malicious repository locked-ioc-18/Voistace/EQVita and Pages site locked-ioc-7 observed distributing locked-ioc-10 (fake v1.3 mimicking genuine v1.10).
• 2026-06-18 Malwarebytes Threat Intelligence publishes analysis of the fake EQVita GitHub repo targeting the PlayStation Vita homebrew / retro gaming modding community.

Sources cited for SmartLoader EQVita GitHub lure

• AI Assisted Fake GitHub Repositories Fuel SmartLoader and LummaStealer Distribution Trend Micro · Research · 2025-03-11
• Disrupting Lumma Stealer: Microsoft leads global action against favored cybercrime tool Microsoft · Vendor report · 2025-05-21
• Fake GitHub Repos Spread SmartLoader, Lumma Stealer Malware anvilogic.com · Research · 2025-03-01
• Lumma Stealer: Breaking down the delivery techniques and capabilities of a prolific infostealer Microsoft · Vendor report · 2025-05-21
• Lumma Stealer Malware: Analysis, Detection, Removal (Huntress Threat Library) Huntress · Research · 2025-01-01
• Retro gaming fans are the new target for fake GitHub malware malwarebytes.com · Blog · 2026-06-18
• Disrupting Lumma Stealer Malware - Microsoft Leads Global Action socradar.io · Blog · 2025-05-21
• Lumma malware threat disrupted as DOJ and Microsoft takedown over 2300 malicious domains cybernews.com · News · 2025-05-21
• AI-Powered Deception: Fake GitHub Repositories Spread SmartLoader and Lumma Stealer securityonline.info · News · 2025-03-01

Threats related to SmartLoader EQVita GitHub lure

• TonRAT Phishing Campaign Impersonating Booking.com Targets Hotel Industry
• PamStealer: macOS Infostealer Distributed via Fake Maccy Sites Using PAM Password Validation
• PureCrypter — C# Malware-as-a-Service Loader Distributing 10+ Malware Families
• WeedHack MaaS Campaign: Minecraft Fake Mod Loader with RSA-Signed Blockchain C2 (LoaderClient)
• OpenClaw Trap: AI-Assisted LuaJIT Malware Factory Targeting Developers & Gamers via GitHub Supply Chain

Related coverage of this activity

• GST Debit Note Remcos loader
• Agent Tesla MaaS keylogger
• Millenium RAT ShinyEnigma MaaS
• TonRAT hospitality photo ZIP
• NanoCore VBScript obfuscated loader

More from Water Kurita

• TroyDens — Fake AI Tool Campaign Delivers SmartLoader Info-Stealer via Trojanized GitHub Repos
• FakeGit Campaign: 7,600 Malicious GitHub Repos Push SmartLoader and StealC Malware via AI Tool Poisoning (Water Kurita)

Previous and next in malware

• Infostealer Campaign Targeting Roblox Developers via Malicious 'robase' Python Package and Fake Discord Job Offers Previous report
• Roblox Developer Group Takeovers via Malicious 'robase' Python Package and Discord Job-Offer Social Engineering Next report