# FakeGit Campaign Uses 7,600 GitHub Repositories with AgentBaiting to Spread SmartLoader & StealC Malware

> A large-scale, Vietnamese-speaking-operator campaign dubbed FakeGit has published roughly 7,600 malicious GitHub repositories (from ~6,600 fake profiles, 800+ posing as AI Skills/MCP servers) to distribute a LuaJIT-based SmartLoader that deploys the StealC information stealer, driving over 14 million downloads via GitHub Release assets as of July 2026. The campaign pioneers 'AgentBaiting' — AI-targeted social engineering that gets Claude Code, Gemini, and ChatGPT coding agents to autonomously discover and recommend the malicious repositories to users.

- **Published:** 2026-07-20T00:00:00Z
- **Last reviewed:** 2026-07-20T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1565
- **ID:** TL-2026-1565
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** FakeGit Operator
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)

## Description

FakeGit is an active, ongoing GitHub-native malware distribution campaign first observed on VirusTotal in mid-March 2025 and still expanding as of July 2026, per joint reporting from Island (lead researcher Oleg Zaytsev) and independent analysis published on Derp.ca. The operator floods GitHub with lookalike repositories that clone the names, READMEs, and star-farming patterns of legitimate open-source projects — including a novel wave of ~800 repositories impersonating AI Skills and Model Context Protocol (MCP) servers for tools like Gmail, WhatsApp, Databricks, Jenkins, and Docker integrations. A subset of these listings (600+) were also submitted to public MCP/Skill registries such as LobeHub, Glama, MCP.so, and MCP Market.

The campaign's defining innovation is 'AgentBaiting': rather than relying solely on human victims clicking malicious links, the attackers write README documentation formatted to be maximally 'agent-legible' so that AI coding assistants (Anthropic Claude Code, Google Gemini, OpenAI ChatGPT) searching the web or GitHub on a user's behalf will independently surface, trust, and relay installation instructions for the malicious repository — for example in response to prompts like 'find a free claude cinematic prompt skill' or 'give me a free walmart MCP server link'. This removes the need for the attacker to control the initial link a victim clicks; the AI agent itself becomes an unwitting distribution vector.

Victims (human or AI-agent-directed) are guided to download a ZIP archive containing a `.cmd` launcher that executes a renamed/trojanized LuaJIT runtime against a heavily obfuscated Lua bytecode payload (SmartLoader). The Lua payload uses a custom base64 alphabet backed by a 1,078-entry lookup table, a three-pass table shuffle, and a state-machine bytecode dispatcher so that all strings and API names are assembled only at runtime; ESET has cataloged 16 distinct obfuscator generations (Lua/Agent.Z through Lua/Agent.BT), and static detection on recent samples has dropped from 27/76 (March 2025) to 0/76. SmartLoader establishes persistence via a scheduled task under %LOCALAPPDATA%, uses LuaJIT FFI to call Win32 APIs directly (GetDC/BitBlt for screenshots, VirtualAlloc+PEB-walking for manual DLL resolution, GetConsoleWindow+ShowWindow(SW_HIDE) for console-hiding), and resolves its command-and-control address through an EtherHiding technique — reading a URL/IP value out of a Polygon (Polygon Mainnet) smart contract rather than a hardcoded domain, allowing the operator to rotate infrastructure without shipping new binaries. Two publicly documented contracts are in use: a V1 contract (getDomain(), deployed 2025-02-21, later destroyed and replaced) and a V2 contract (getData(), deployed 2025-11-15).

After C2 resolution, the loader pulls two hex-encoded, XOR-encrypted 'dead drop' blobs from attacker-controlled GitHub repositories: a smaller (~594KB) updated Lua payload and a larger (~2.3MB) PE crypter stub. Both are decrypted with a shared 32-byte XOR key assembled at runtime from the obfuscated lookup table. The PE crypter is an x64 GUI binary whose RCDATA resource holds ~1MB of base64url-encoded, AES-256-ECB-encrypted content; at RVA 0x1000 it XORs two hardcoded 32-byte constants via AVX2 instructions to derive the AES key at runtime, then injects the final payload — the StealC information stealer — into a fresh process via classic process hollowing (CreateProcessA in a suspended state, NtUnmapViewOfSection, VirtualAllocEx, WriteProcessMemory, SetThreadContext, ResumeThread).

StealC is a widely available Malware-as-a-Service (MaaS) infostealer, in circulation since late 2022/early 2023 and advertised around $200/month on cybercrime forums, now at version 2.x with a JSON-based C2 protocol and a redesigned web panel. In the FakeGit chain it is configured to harvest Chrome/Brave/Edge browser data (Login Data, Cookies, Web Data, History, IndexedDB) including a bypass for Chromium App-Bound Encryption via the os_crypt/encrypted_key value in Local State, Firefox credentials via NSS3 (logins.json, cookies.sqlite), Outlook and FoxMail email data, WinSCP SSH sessions, Steam gaming tokens (ssfn*, config.vdf, loginusers.vdf), live browser session cookies (not just stored passwords), browser extension data, and desktop screenshots via GDI+. Its configuration is RC4-encrypted with the key stored as the first string in the .rdata section.

Infrastructure analysis identified 48 distinct loader C2 IPs, heavily concentrated (37 of 48) on ASN 207957 (Serv.host Group Ltd, apparent bulletproof hosting), with smaller footprints on ASN 213702 (QWINS) and several minor ASNs. Two dedicated StealC C2 IPs were identified: 217.119.129.110 (Latvia) and 213.176.72.200 (United Kingdom), both also on ASN 207957. Early campaign infrastructure used domains layer1.icu (registered 2025-02-21) and aproxy.app (registered 2025-03-10) before transitioning to raw IP addressing by mid-March 2025. One shared C2 IP, 151.243.113.70, was also observed hosting unrelated concurrent malware families (ANDROMEDA, Wallstealer, LummaC2, Aurora), suggesting shared bulletproof-hosting infrastructure used across multiple criminal operations rather than exclusive FakeGit ownership.

Single-operator attribution is supported by identical inner payloads reused across dozens of unrelated lure themes (productivity tools, gaming cheats/cracks, crypto/trading schemes, adult content, and a fake 7-Zip CVE-2025-0411 PoC), consistent with a Vietnamese-speaking threat actor per Derp.ca's linguistic and infrastructure analysis. At least five legitimate developer GitHub accounts were compromised and used to host malicious repositories alongside purpose-created sockpuppet accounts, some using single-character-variation usernames (e.g., Naveenkm007 vs. the legitimate Naveenkm07) to impersonate trusted maintainers. As of the July 2026 reporting the campaign remains active, with 25+ malicious GitHub accounts still live and distributing payloads.

## MITRE ATT&CK

- T1589.002 Email Addresses
- T1586.001 Social Media Accounts
- T1583.005 Botnet
- T1587.001 Malware
- T1566.002 Spearphishing Link
- T1195.002 Compromise Software Supply Chain
- T1204.002 Malicious File
- T1059.007 JavaScript
- T1106 Native API
- T1053.005 Scheduled Task
- T1547.005 Security Support Provider
- T1055.012 Process Hollowing
- T1036.005 Match Legitimate Resource Name or Location
- T1036.007 Double File Extension
- T1218 System Binary Proxy Execution
- T1027 Obfuscated Files or Information
- T1027.002 Software Packing
- T1140 Deobfuscate/Decode Files or Information
- T1055.012 Process Hollowing
- T1564.003 Hidden Window
- T1555.003 Credentials from Web Browsers
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1552.001 Credentials In Files
- T1528 Steal Application Access Token
- T1082 System Information Discovery
- T1113 Screen Capture
- T1005 Data from Local System
- T1102.001 Dead Drop Resolver
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography
- T1041 Exfiltration Over C2 Channel

## Sources

- [FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware](https://thehackernews.com/2026/07/fakegit-campaign-uses-7600-github.html)
- [AgentBaiting: How 800 Fake AI Skills and MCP Servers Delivered Malware](https://www.island.io/blog/agentbaiting-how-800-fake-ai-skills-and-mcp-servers-delivered-malware)
- [FakeGit LuaJIT GitHub Campaign — Technical Research](https://www.derp.ca/research/fakegit-luajit-github-campaign/)
- [StealC v2 Malware Enhances Stealth and Expands Data Theft Features](https://www.picussecurity.com/resource/blog/stealc-v2-malware-enhances-stealth-and-expands-data-theft-features)
- [New 'Stealc' Malware Builds on Prevalent Infostealers](https://rhisac.org/threat-intelligence/new-stealc-malware-builds-on-prevalent-infostealers/)
- [Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141b)
- [Lumma Infostealer Data Exfiltration Campaign Continues via GitHub Social Engineering](https://www.picussecurity.com/resource/blog/lumma-infostealer-continues-its-github-social-engineering-campaign)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1565