# Fake GitHub 'EQVita' Homebrew Repo Delivers SmartLoader and Lumma Stealer to the Retro Gaming / PlayStation Vita Modding Community

> A malicious GitHub campaign impersonates EQVita, a free audio/EQ tool for the PlayStation Vita homebrew scene, distributing a trojanized EQ_Vita_v1.3.zip. A legitimate luajit.exe is abused to execute a disguised obfuscated Lua script (x64.txt) that performs geolocation checks and beacons to attacker C2 at 85.137.52.21, deploying SmartLoader which in turn fetches the Lumma Stealer (LummaC2) information stealer to harvest saved browser passwords, session cookies, and cryptocurrency wallets.

- **Published:** 2026-06-18T00:00:00Z
- **Last reviewed:** 2026-06-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0849
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-smartloader-eqvita-github-lure-tl-2026-0849.webp?v=2ce72c7e (Threadlinqs threat intel: SmartLoader Fake GitHub EQVita Repo: Detection & IOCs (TL-2026-0849) — High severity, 21 IOCs, 9 detection rules.)
- **ID:** TL-2026-0849
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Water Kurita
- **Detections:** 9 (1 shown free below) · **IOCs:** 21 (3 shown free below)

## Description

Malwarebytes Threat Intelligence reported on June 18, 2026 that operators behind the broader SmartLoader/Lumma Stealer fake-GitHub ecosystem (overlapping with the actor cluster Trend Micro tracks as Water Kurita and the Lumma developer Microsoft tracks as Storm-2477) have pivoted to social-engineering the retro gaming and console homebrew/modding community. The threat actor stood up a counterfeit GitHub repository at github.com/Voistace/EQVita with a paired GitHub Pages site at voistace.github.io, impersonating EQVita, a legitimate free equalizer/audio utility for the PlayStation Vita homebrew scene. To appear authentic while evading takedown, the fake repo is published as version 1.3 while the genuine project is at version 1.10.

The delivered archive, EQ_Vita_v1.3.zip, follows the signature SmartLoader packaging pattern: a launcher batch file (Launch.bat), a legitimately-signed LuaJIT interpreter (luajit.exe) accompanied by the lua51.dll runtime, and an obfuscated Lua script disguised with a benign .txt extension (x64.txt). Because the EXE and DLL are themselves clean, static AV and reputation checks frequently pass. Launch.bat invokes luajit.exe with x64.txt as an argument; the Lua loader deobfuscates itself in memory, performs geolocation/host reconnaissance, and establishes command-and-control over 'scrambled' (obfuscated/encoded) URLs to attacker infrastructure including the C2 IP 85.137.52.21.

Consistent with the wider Water Kurita campaign, the SmartLoader stage retrieves the Lumma Stealer payload (commonly renamed search.exe) from GitHub-hosted releases, stages an AutoIt interpreter and script (observed elsewhere via Excel/%TEMP% staging and an interpreter masquerading as Research.com), performs findstr-based reconnaissance for endpoint security products (Avast, Norton, Sophos), and launches Microsoft Edge with --remote-debugging-port=9222 to programmatically scrape live browser session data. Lumma Stealer (LummaC2), distributed under a malware-as-a-service model, then exfiltrates Chromium/Gecko browser saved passwords, cookies, autofill data, MFA/login codes, and cryptocurrency wallet artifacts (e.g., MetaMask, Electrum, Exodus) to C2 (campaign infrastructure includes pasteflawwed.world). The campaign demonstrates that any retro platform with an active modding scene is now a viable targeting surface for infostealer delivery.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1608 Stage Capabilities
- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1036 Masquerading
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1218 System Binary Proxy Execution
- T1564 Hide Artifacts
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1528 Steal Application Access Token
- T1082 System Information Discovery
- T1614 System Location Discovery
- T1518 Software Discovery
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Lumma C2 — Edge Remote-Debugging Cookie Scrape + Beacon to Hardcoded IP (C2 / Exfiltration)** (`TL-2026-0849-SPL-003`)

Detects the Lumma Stealer collection and C2 stage: Microsoft Edge launched with --remote-debugging-port=9222 by a non-browser parent (live browser-session/cookie scraping via Chrome DevTools Protocol), and outbound beacons to the campaign C2 IP 85.137.52.21 or domain pasteflawwed.world following interpreter launch. Covers credential/cookie theft, web-protocol C2, ingress tool transfer of the renamed search.exe payload, and exfiltration over the C2 channel.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1539, T1555.003, T1071.001, T1105, T1041
- **Data sources:** sysmon, microsoft_defender_for_endpoint, zeek_network, firewall_proxy
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=1 OR EventCode=3)
| eval edge_debug=if(EventCode=1 AND match(lower(Image),"msedge\.exe$|chrome\.exe$") AND match(CommandLine,"--remote-debugging-port=9222") AND NOT match(lower(ParentImage),"msedge\.exe$|explorer\.exe$|chrome\.exe$"),1,0)
| eval c2_beacon=if(EventCode=3 AND (DestinationIp="85.137.52.21" OR match(lower(DestinationHostname),"pasteflawwed\.world$")),1,0)
| where edge_debug=1 OR c2_beacon=1
| stats count sum(edge_debug) as debug_events sum(c2_beacon) as c2_events values(CommandLine) as cmdlines values(ParentImage) as parents values(DestinationIp) as dest_ips values(DestinationHostname) as dest_hosts min(_time) as firstTime max(_time) as lastTime by host, User
| convert ctime(firstTime) ctime(lastTime)
| where debug_events>0 OR c2_events>0
| sort - lastTime
```

### Microsoft KQL

```kql
let edge_debug = DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName in~ ("msedge.exe","chrome.exe")
    | where ProcessCommandLine has "--remote-debugging-port=9222"
    | where InitiatingProcessFileName !in~ ("msedge.exe","chrome.exe","explorer.exe")
    | project Timestamp, DeviceName, AccountName, Signal="edge_remote_debug", Detail=ProcessCommandLine, Parent=InitiatingProcessFileName;
let c2 = DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where RemoteIP == "85.137.52.21" or RemoteUrl has "pasteflawwed.world"
    | project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, Signal="c2_beacon", Detail=strcat(RemoteIP," ",RemoteUrl), Parent=InitiatingProcessFileName;
union edge_debug, c2
| order by Timestamp desc
```

### Sigma

```yaml
title: Lumma C2 — Edge Remote-Debugging Cookie Scrape and Beacon to EQVita Campaign Infrastructure
id: 8c3f4a62-ae5d-4b43-c2d3-3e4f5a6b7c82
status: experimental
description: Detects Microsoft Edge launched with --remote-debugging-port=9222 by a non-browser parent (live cookie/session scraping) and outbound C2 to EQVita campaign infrastructure, the Lumma Stealer collection/C2 stage (TL-2026-0849).
references:
    - https://www.malwarebytes.com/blog/threat-intel/2026/06/retro-gaming-fans-are-the-new-target-for-fake-github-malware
    - https://www.huntress.com/threat-library/malware/lumma-stealer
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-06-18
tags:
    - attack.credential_access
    - attack.command_and_control
    - attack.exfiltration
    - attack.t1539
    - attack.t1555.003
    - attack.t1071.001
    - attack.t1105
    - attack.t1041
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith: '\msedge.exe'
        CommandLine|contains: '--remote-debugging-port=9222'
    filter_parent:
        ParentImage|endswith:
            - '\msedge.exe'
            - '\explorer.exe'
    condition: selection and not filter_parent
falsepositives:
    - Developers or automated browser tests (Selenium/Puppeteer/Playwright) legitimately using remote-debugging
level: high
```

**Known false positives:**

- Browser-automation frameworks (Selenium, Puppeteer, Playwright) or developers legitimately using --remote-debugging-port
- Security tooling that proxies/inspects browser sessions

**Tuning notes:** Allowlist known automation hosts/service accounts for the remote-debugging branch. Keep the IOC list (85.137.52.21, pasteflawwed.world) refreshed from current threat intel and treat it as exact-match high-confidence. Escalate when the Edge remote-debug event and a C2 beacon occur on the same host within minutes of a SPL-001 LuaJIT hit.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- SmartLoader Package Pattern — Bundled Interpreter Spawned by [indicator] (Exploitation) (locked: unlock with TL Creds)
- SmartLoader In-Memory Deobfuscation + Geolocation/Host Recon Following LuaJIT Launch (Post-Exploitation) (locked: unlock with TL Creds)
- Lumma C2 / Ingress Tool Transfer — Beacon to [indicator] and [indicator] Retrieval (C2 / Lateral) (locked: unlock with TL Creds)
- SmartLoader LuaJIT .txt Loader From User-Writable Path — Sigma (Exploitation) (locked: unlock with TL Creds)
- SmartLoader HKCU Run-Key Persistence To User-Writable Launcher — Sigma (Post-Exploitation) (locked: unlock with TL Creds)
- Lumma Edge Remote-Debugging Cookie Scrape by Non-Browser Parent — Sigma (C2 / Lateral) (locked: unlock with TL Creds)
- SmartLoader LuaJIT LOLBin — Signed Interpreter Executing .txt Loader From User-Writable Path (Exploitation) (locked: unlock with TL Creds)
- SmartLoader Post-Exploitation — Findstr AV Reconnaissance + HKCU Run-Key Persistence (Post-Exploitation) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 21)

Defanged, TLP:CLEAR.

- IP address: `85.137.52[.]21`
- Domain: `voistace[.]github[.]io`
- Domain: `pasteflawwed[.]world`

Full set of 21 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Retro gaming fans are the new target for fake GitHub malware](https://www.malwarebytes.com/blog/threat-intel/2026/06/retro-gaming-fans-are-the-new-target-for-fake-github-malware)
- [AI Assisted Fake GitHub Repositories Fuel SmartLoader and LummaStealer Distribution](https://www.trendmicro.com/en_us/research/25/c/ai-assisted-fake-github-repositories.html)
- [Disrupting Lumma Stealer: Microsoft leads global action against favored cybercrime tool](https://blogs.microsoft.com/on-the-issues/2025/05/21/microsoft-leads-global-action-against-favored-cybercrime-tool/)
- [Lumma malware threat disrupted as DOJ and Microsoft takedown over 2300 malicious domains](https://cybernews.com/security/lumma-infostealer-malware-2300-domains-seized-microsoft/)
- [Fake GitHub Repos Spread SmartLoader, Lumma Stealer Malware](https://www.anvilogic.com/threat-reports/github-lumma-stealer-campaign)
- [Lumma Stealer: Breaking down the delivery techniques and capabilities of a prolific infostealer](https://www.microsoft.com/en-us/security/blog/2025/05/21/lumma-stealer-breaking-down-the-delivery-techniques-and-capabilities-of-a-prolific-infostealer/)
- [Disrupting Lumma Stealer Malware - Microsoft Leads Global Action](https://socradar.io/blog/disrupting-lumma-stealer-malware-microsoft-leads-global-action/)
- [Lumma Stealer Malware: Analysis, Detection, Removal (Huntress Threat Library)](https://www.huntress.com/threat-library/malware/lumma-stealer)
- [AI-Powered Deception: Fake GitHub Repositories Spread SmartLoader and Lumma Stealer](https://securityonline.info/ai-powered-deception-fake-github-repositories-spread-smartloader-and-lumma-stealer/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0849