Fake GitHub 'EQVita' Homebrew Repo Delivers SmartLoader and Lumma Stealer to the Retro Gaming / PlayStation Vita Modding Community
Fake GitHub 'EQVita' Homebrew Repo Delivers SmartLoader and (TL-2026-0849), also tracked as EQVita fake repo campaign, is a high-severity malware campaign, first published 2026-06-18. It is attributed to Water Kurita with medium confidence, affects Microsoft Windows, maps to 21 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 21 indicators of compromise.
Key facts for TL-2026-0849
- Threat ID
- TL-2026-0849
- Also known as
- EQVita fake repo campaign, Voistace EQVita, SmartLoader retro-gaming lure
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-18
- Last reviewed
- 2026-06-18
- Attribution
- Water Kurita
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- gaming, consumer, technology, individual-users
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 21
Malware and tooling in Fake GitHub 'EQVita' Homebrew Repo Delivers SmartLoader and
Malware and tooling: Lumma Stealer - S1213, SmartLoader, AutoIt
A malicious GitHub campaign impersonates EQVita, a free audio/EQ tool for the PlayStation Vita homebrew scene, distributing a trojanized EQ_Vita_v1.3.zip. A legitimate luajit.exe is abused to execute a disguised obfuscated Lua script (x64.txt) that performs geolocation checks and beacons to attacker C2 at 85.137.52.21, deploying SmartLoader which in turn fetches the Lumma Stealer (LummaC2) information stealer to harvest saved browser passwords, session cookies, and cryptocurrency wallets.
How Fake GitHub 'EQVita' Homebrew Repo Delivers SmartLoader and works
Malwarebytes Threat Intelligence reported on June 18, 2026 that operators behind the broader SmartLoader/Lumma Stealer fake-GitHub ecosystem (overlapping with the actor cluster Trend Micro tracks as Water Kurita and the Lumma developer Microsoft tracks as Storm-2477) have pivoted to social-engineering the retro gaming and console homebrew/modding community. The threat actor stood up a counterfeit GitHub repository at github.com/Voistace/EQVita with a paired GitHub Pages site at voistace.github.io, impersonating EQVita, a legitimate free equalizer/audio utility for the PlayStation Vita homebrew scene. To appear authentic while evading takedown, the fake repo is published as version 1.3 while the genuine project is at version 1.10.
The delivered archive, EQ_Vita_v1.3.zip, follows the signature SmartLoader packaging pattern: a launcher batch file (Launch.bat), a legitimately-signed LuaJIT interpreter (luajit.exe) accompanied by the lua51.dll runtime, and an obfuscated Lua script disguised with a benign .txt extension (x64.txt). Because the EXE and DLL are themselves clean, static AV and reputation checks frequently pass. Launch.bat invokes luajit.exe with x64.txt as an argument; the Lua loader deobfuscates itself in memory, performs geolocation/host reconnaissance, and establishes command-and-control over 'scrambled' (obfuscated/encoded) URLs to attacker infrastructure including the C2 IP 85.137.52.21.
Consistent with the wider Water Kurita campaign, the SmartLoader stage retrieves the Lumma Stealer payload (commonly renamed search.exe) from GitHub-hosted releases, stages an AutoIt interpreter and script (observed elsewhere via Excel/%TEMP% staging and an interpreter masquerading as Research.com), performs findstr-based reconnaissance for endpoint security products (Avast, Norton, Sophos), and launches Microsoft Edge with --remote-debugging-port=9222 to programmatically scrape live browser session data. Lumma Stealer (LummaC2), distributed under a malware-as-a-service model, then exfiltrates Chromium/Gecko browser saved passwords, cookies, autofill data, MFA/login codes, and cryptocurrency wallet artifacts (e.g., MetaMask, Electrum, Exodus) to C2 (campaign infrastructure includes pasteflawwed.world). The campaign demonstrates that any retro platform with an active modding scene is now a viable targeting surface for infostealer delivery.
MITRE ATT&CK techniques used in TL-2026-0849
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1564 Hide Artifacts
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer
Discovery
T1082 System Information Discovery; T1518 Software Discovery; T1614 System Location Discovery
Credential Access
T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores
Persistence
T1547 Boot or Logon Autostart Execution
Initial Access
Resource Development
Affected products and versions in Fake GitHub 'EQVita' Homebrew Repo Delivers SmartLoader and
- Microsoft — Windows
Vulnerable versions: 10; 11 - Chromium / Mozilla — Web browsers (saved credentials, cookies, autofill)
Vulnerable versions: Chromium-based; Gecko-based - Cryptocurrency wallets — MetaMask / Electrum / Exodus and similar
Vulnerable versions: browser-extension and desktop wallets
Remediation for Fake GitHub 'EQVita' Homebrew Repo Delivers SmartLoader and
Immediate actions
- Block C2 IP 85.137.52.21 and domain pasteflawwed.world at the perimeter/DNS layer
- Block/monitor the malicious distribution hosts github.com/Voistace/EQVita and voistace.github.io
- Hunt for luajit.exe / lua51.dll executing from user-writable paths (Downloads, %TEMP%, Desktop) with a .txt script argument
- Hunt for msedge.exe launched with --remote-debugging-port=9222 by a non-browser parent process
- Quarantine any EQ_Vita_v1.3.zip, x64.txt, Launch.bat, or search.exe artifacts and force-reset credentials/wallet seeds on affected hosts
Workarounds
- Only download homebrew tools from verified official project sources and confirm version numbers (genuine EQVita is v1.10, not v1.3)
- Disable browser remote-debugging where not required and monitor port 9222 binds
Longer-term hardening
- Deploy EDR with behavioral detection for LOLBin abuse (LuaJIT loader pattern) and browser remote-debugging scraping
- Restrict execution of unsigned/interpreter binaries from user-writable directories via WDAC/AppLocker
- Enforce application allowlisting and block AutoIt interpreters outside approved use
- Security-awareness training for staff who use homebrew/modding/gaming tools on managed devices
Weaknesses (CWE) in Fake GitHub 'EQVita' Homebrew Repo Delivers SmartLoader and
CWE-506, CWE-829
Timeline of Fake GitHub 'EQVita' Homebrew Repo Delivers SmartLoader and
- Lumma Stealer (LummaC2), a C-language infostealer, is first observed advertised on Russian-speaking underground forums and sold under a malware-as-a-service model (developer later tracked by Microsoft as Storm-2477).
- Trend Micro's Threat Hunting team publishes its report on the Water Kurita campaign, documenting AI-generated fake GitHub repositories that deploy SmartLoader to deliver Lumma Stealer, disguising malware as gaming cheats, cracked software, and system tools.
- Start of the window during which Microsoft identifies over 394,000 Windows computers worldwide infected by Lumma Stealer (March 16 - May 16, 2025).
- Microsoft's Digital Crimes Unit, the U.S. DOJ, and global partners disrupt Lumma Stealer infrastructure, seizing/blocking approximately 2,300 malicious domains along with the malware's command structure and sales marketplaces.
- Despite the takedown, Lumma operators rapidly restore command-and-control infrastructure and resume distribution, underscoring the resilience of the MaaS platform.
- SmartLoader stage fetches and executes Lumma Stealer to harvest browser passwords, cookies, login/MFA codes, and cryptocurrency wallets.
- Launch.bat invokes legitimate luajit.exe to run the disguised obfuscated Lua script x64.txt, which performs geolocation checks and beacons to C2 85.137.52.21 via an obfuscated web address.
- Malicious repository github.com/Voistace/EQVita and Pages site voistace.github.io observed distributing EQ_Vita_v1.3.zip (fake v1.3 mimicking genuine v1.10).
- Malwarebytes Threat Intelligence publishes analysis of the fake EQVita GitHub repo targeting the PlayStation Vita homebrew / retro gaming modding community.
Sources cited for Fake GitHub 'EQVita' Homebrew Repo Delivers SmartLoader and
- Retro gaming fans are the new target for fake GitHub malware
- AI Assisted Fake GitHub Repositories Fuel SmartLoader and LummaStealer Distribution
- Disrupting Lumma Stealer: Microsoft leads global action against favored cybercrime tool
- Lumma malware threat disrupted as DOJ and Microsoft takedown over 2300 malicious domains
- Fake GitHub Repos Spread SmartLoader, Lumma Stealer Malware
- Lumma Stealer: Breaking down the delivery techniques and capabilities of a prolific infostealer
- Disrupting Lumma Stealer Malware - Microsoft Leads Global Action
- Lumma Stealer Malware: Analysis, Detection, Removal (Huntress Threat Library)
- AI-Powered Deception: Fake GitHub Repositories Spread SmartLoader and Lumma Stealer
Threats related to Fake GitHub 'EQVita' Homebrew Repo Delivers SmartLoader and
- TonRAT Phishing Campaign Impersonating Booking.com Targets Hotel Industry
- PamStealer: macOS Infostealer Distributed via Fake Maccy Sites Using PAM Password Validation
- PureCrypter — C# Malware-as-a-Service Loader Distributing 10+ Malware Families
- WeedHack MaaS Campaign: Minecraft Fake Mod Loader with RSA-Signed Blockchain C2 (LoaderClient)
- OpenClaw Trap: AI-Assisted LuaJIT Malware Factory Targeting Developers & Gamers via GitHub Supply Chain
- Agent Tesla .NET Remote Access Trojan — Credential and Data Theft via Keylogging and MaaS Operations
Detection coverage for TL-2026-0849
As of 2026-06-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0849 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.