FakeGit Campaign: 7,600 Malicious GitHub Repos Push SmartLoader and StealC Malware via AI Tool Poisoning (Water Kurita)
FakeGit Campaign (TL-2026-1595), also tracked as FakeGit, is a high-severity malware campaign, first published 2026-07-21. It is attributed to Water Kurita with high confidence, affects GitHub GitHub repository hosting / Release assets, maps to 31 MITRE ATT&CK techniques (T1005, T1027, T1033), and is covered by 9 detection rules and 28 indicators of compromise.
Key facts for TL-2026-1595
- Threat ID
- TL-2026-1595
- Also known as
- FakeGit
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-21
- Last reviewed
- 2026-07-21
- Attribution
- Water Kurita
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- technology, softwaredevelopment, finance, retail, generaldevelopercommunity
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in FakeGit Campaign
Malware and tooling: Lumma Stealer - S1213, SmartLoader, Stealc, LuaJIT 2.1.0-beta3, Polygon smart contract dead-drop resolver, Prometheus obfuscator
Threat actor Water Kurita operates 'FakeGit', a large-scale campaign using over 7,600 malicious GitHub repositories disguised as AI tools, agents, MCP servers, and cracked software to distribute the LuaJIT-based SmartLoader, which persists via scheduled tasks and delivers the StealC infostealer (previously Lumma Stealer). The novel 'AgentBaiting' technique poisons AI tool registries (LobeHub, Glama, MCP.so, MCP Market) with fabricated documentation so malicious repos surface directly in AI coding-assistant search/install recommendations (demonstrated against Claude Code, Gemini, and ChatGPT), while SmartLoader resolves its C2 endpoint via a Polygon blockchain smart-contract dead-drop.
How FakeGit Campaign works
FakeGit is a large-scale, ongoing malware distribution campaign attributed to Water Kurita, a threat actor Trend Micro also tracks as the operator behind the Lumma Stealer Malware-as-a-Service (MaaS) offering. The actor floods GitHub with fake repositories (over 7,600 cataloged, spanning 103+ accounts in a related 109-repo sub-cluster) that mimic legitimate open-source tools, game cheats, cracked software, cryptocurrency utilities, and — in the campaign's newest and most novel evolution beginning March 2026 and peaking in April 2026 — over 800 fake 'AI Skills' and Model Context Protocol (MCP) servers. Water Kurita uses generative AI to automate convincing README files, fabricated star/download metrics, and lookalike developer profiles, then seeds these into public AI-tool registries (LobeHub, Glama, MCP.so, MCP Market), which frequently reproduce the attacker-authored README verbatim, amplifying reach. Roughly 600+ registry listings and 14,084,688 cumulative measured downloads (across 335 unique GitHub Release assets from 211 repositories) resulted.
The operation's signature innovation is 'AgentBaiting': rather than relying solely on humans clicking malicious links, the attacker crafts repositories so that AI coding agents and chat assistants performing autonomous tool/capability discovery will surface the malicious repo organically and recommend its installation instructions to the end user, without ever being shown a link. Island.io's controlled testing confirmed this works against Anthropic Claude Code (which independently discovered and, in some runs, recommended installation instructions for the malicious repo 'adlaiponderous700/claude-skill-cinematic-prompt'), Google Gemini (which recommended 'DomingosNgongo/walmart-mcp' as its top pick for a 'free Walmart MCP server', a repo confirmed to contain SmartLoader), and OpenAI ChatGPT (which listed the same repository as a top-three, 'best starting point' recommendation). Roughly 62% of AI-themed lures targeted enterprise/developer workflows: Databricks analytics and enterprise data (33%), source-code access via tools like Jenkins CI/CD (25%), and credential/secret harvesting (17%), using lures such as Docker infrastructure helpers and Splunk SOC dashboards.
Victims who follow the README instructions download a ZIP archive embedded deep in the repository's directory structure, disguised as a normal build artifact (e.g., 'project-name-version.zip'). The archive contains a batch launcher, a renamed LuaJIT 2.1.0-beta3 runtime, and an obfuscated Lua payload stored under an innocuous .txt/.log extension; the launcher invokes the runtime via the Windows 'start' command against a GUI-subsystem binary to suppress the console window. The resulting single-line SmartLoader script (~300KB, Prometheus-obfuscated with arithmetic-masked constants, encoded strings, randomized identifiers, and a VM-style dispatcher) fingerprints the host, performs anti-debug checks, captures screenshots via the Windows GDI API, and uses LuaJIT's FFI to declare and call Windows APIs directly, loading follow-on PE payloads reflectively in memory without touching disk.
SmartLoader's command-and-control is blockchain-resilient: it issues a JSON-RPC eth_call to the public Polygon RPC endpoint polygon.drpc.org against a fixed on-chain dead-drop smart contract (0x1823A9a0Ec8e0C25dD957D0841e3D41a4474bAdc, function selector 0x3bc5de30 / getData), which returns an encoded string decoded client-side into the live C2 URL — a bare-IP HTTP endpoint within a single /24 block. This lets the actor rotate takedown-resistant infrastructure at will since the resolver itself (a public, censorship-resistant blockchain) cannot be seized. The malware then POSTs host metadata, fingerprint data, and screenshots as multipart/form-data to /api/<victim_id>, polls for tasking, decrypts server-issued instructions in memory, and reports task completion (typically HTTP 204) to /task/<victim_id>.
SmartLoader's primary follow-on payload is StealC, delivered as an encrypted blob containing a redundant Lua stage plus a packed StealC PE, executed reflectively via SmartLoader's in-memory PE loader from GitHub-hosted encrypted blobs. StealC (first observed late 2022, offered as MaaS in C++) targets browser-stored credentials, session/authentication cookies, FTP client credentials, and cryptocurrency wallets; the current StealC v2 ('Monster V2', $200/month subscription, v2.2.4 as of November 2025) adds a JSON-based C2 protocol, multi-monitor screenshot capture, a unified file grabber, and enhanced session-restoration-file extraction. Persistence is established via two masked Scheduled Tasks disguised as benign software components (e.g., audio managers or Office components) pointing at binaries/Lua stages cached under %LOCALAPPDATA%: one re-executes the cached Lua stage to survive a GitHub repository takedown, and the second re-downloads a fresh encrypted stage from GitHub to recover from local endpoint cleanup.
Water Kurita previously operated the same fake-GitHub-repository delivery model to distribute Lumma Stealer as its own MaaS product. Following a January 2025 law-enforcement takedown that seized over 2,300 Lumma-associated domains, and a subsequent underground doxxing operation against alleged Lumma core members that coincided with a sharp activity decline, the actor pivoted its GitHub-based distribution infrastructure toward SmartLoader + StealC while retaining and refining the generative-AI-assisted repository content pipeline — and, in 2026, extending it into the AI tool/agent ecosystem via AgentBaiting.
MITRE ATT&CK techniques used in TL-2026-1595
Collection
T1005 Data from Local System; T1113 Screen Capture; T1560 Archive Collected Data
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1564 Hide Artifacts; T1620 Reflective Code Loading
Discovery
T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1106 Native API; T1204 User Execution
Persistence
T1053 Scheduled Task/Job; T1547 Boot or Logon Autostart Execution
Command and Control
T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1132 Data Encoding
Initial Access
T1195 Supply Chain Compromise; T1199 Trusted Relationship; T1566 Phishing
Credential Access
T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores
Resource Development
T1583 Acquire Infrastructure; T1585 Establish Accounts; T1587 Develop Capabilities
Impact
Affected products and versions in FakeGit Campaign
- GitHub — GitHub repository hosting / Release assets
Vulnerable versions: N/A - platform abuse, not a software vulnerability - LobeHub — LobeHub AI tool/agent registry
Vulnerable versions: N/A - registry abuse via listing poisoning - Glama — Glama MCP server registry
Vulnerable versions: N/A - registry abuse via listing poisoning - MCP.so — MCP.so registry
Vulnerable versions: N/A - registry abuse via listing poisoning - MCP Market — MCP Market registry
Vulnerable versions: N/A - registry abuse via listing poisoning - Anthropic — Claude Code
Vulnerable versions: Autonomous Skill/tool discovery feature - version-agnostic behavioral susceptibility - Google — Gemini (AI assistant/coding agent)
Vulnerable versions: Autonomous capability search/recommendation feature - version-agnostic behavioral susceptibility - OpenAI — ChatGPT
Vulnerable versions: Autonomous capability search/recommendation feature - version-agnostic behavioral susceptibility - Microsoft — Windows (endpoint OS targeted by SmartLoader/StealC)
Vulnerable versions: All supported Windows versions
Remediation for FakeGit Campaign
Immediate actions
- Block outbound HTTP connections to bare-IP endpoints (no reverse DNS/hostname) outside approved allowlists, particularly within the flagged /24 block used for SmartLoader C2
- Alert on and block non-browser JSON-RPC calls to polygon.drpc.org and other public blockchain RPC endpoints from developer/engineering workstations
- Hunt for unsigned LuaJIT (lua51.dll / luajit.exe) binaries or renamed LuaJIT runtimes launched via batch files with .txt/.log arguments from user-writable paths (%TEMP%, %LOCALAPPDATA%, Downloads)
- Audit Scheduled Tasks for entries masquerading as audio managers, Office components, or other benign software pointing at binaries under %LOCALAPPDATA%
- Revoke and rotate browser sessions, OAuth grants, API tokens, and cloud credentials on any host suspected of StealC execution — session theft, not just passwords, is the primary risk
- Block/quarantine known malicious repository and package hashes (SHA-256 IOCs) at endpoint and network egress control points
Workarounds
- Disable autonomous/unattended tool discovery features in AI coding assistants (Claude Code, Gemini, ChatGPT) for environments handling sensitive credentials or production data; require human review of any AI-agent-suggested installation instructions
- Reject any GitHub release asset/ZIP that embeds an executable, batch launcher, or renamed script-runtime deep within nested directory structures disguised as build artifacts
Longer-term hardening
- Maintain a curated, reviewed catalog of approved AI Skills/MCP servers for use by AI coding agents rather than allowing open, autonomous discovery of third-party capabilities
- Require isolated/sandboxed evaluation of any newly discovered Skill, MCP server, or GitHub tool before granting it credentials or production data access
- Implement publisher/developer verification workflows for registries (LobeHub, Glama, MCP.so, MCP Market) beyond simple listing acceptance, including detection of one-character-off lookalike usernames
- Deploy agent-activity monitoring to track AI-agent-initiated git clones, package installs, and Skill/MCP directory changes as a distinct telemetry stream
- Maintain an inventory of approved source repositories, pinned commits, package versions, and expected file hashes to enable rapid IOC matching against future campaign waves
Timeline of FakeGit Campaign
- Law enforcement seizes over 2,300 domains associated with Water Kurita's Lumma Stealer MaaS operation, disrupting the group's GitHub-based delivery infrastructure.
- Trend Micro reports Lumma Stealer's return with stealthier delivery methods, indicating Water Kurita rebuilt distribution capability post-takedown.
- Underground doxxing operation exposes alleged Water Kurita/Lumma Stealer core members, coinciding with a sharp decline in observed group activity.
- Water Kurita introduces AI-themed lures into the FakeGit campaign, beginning the pivot toward fake AI Skills and MCP server repositories.
- FakeGit campaign activity peaks with approximately 300 AI-themed repositories created in the month, alongside continued non-AI lures (game cheats, cracked software).
- Security researchers identify a 109-repository sub-cluster across 103 GitHub accounts distributing SmartLoader and StealC via the Polygon smart-contract C2 mechanism.
- Trend Micro publishes research formally attributing the AI-assisted fake GitHub repository campaign (SmartLoader + Lumma Stealer distribution lineage) to Water Kurita.
- Island.io publishes AgentBaiting research demonstrating that Claude Code, Gemini, and ChatGPT autonomously surfaced and recommended malicious FakeGit repositories during capability-discovery tasks.
- BleepingComputer reports the full scale of the FakeGit campaign: 7,600 malicious GitHub repositories, 14M+ cumulative downloads, and 600+ AI registry listings across LobeHub, Glama, MCP.so, and MCP Market.
Sources cited for FakeGit Campaign
- FakeGit campaign uses 7,600 GitHub repos to push SmartLoader malware
- AI Assisted Fake GitHub Repositories Fuel SmartLoader and LummaStealer Distribution
- AgentBaiting: How Fake AI Skills and MCP Servers Delivered Malware
- AgentBaiting Uses Fake AI Skills and MCP Servers to Deliver SmartLoader and StealC Malware
- AgentBaiting: FakeGit Weaponizes 800+ Fake AI Skills for SmartLoader
- FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware
- Active Exploitation Alert: FakeGit Campaign Abuses 7,600 GitHub Repositories to Distribute SmartLoader and Lumma Stealer Malware via Open-Source Supply Chain
- 109 Fake GitHub Repos Spread SmartLoader, StealC Malware
- Cloned, Loaded, and Stolen: How 109 Fake GitHub Repositories Delivered SmartLoader and StealC
- 109 Fake GitHub Repositories Used to Deliver SmartLoader and StealC Malware
- SmartLoader & StealC Campaign: Blockchain C2 and Fraudulent GitHub Repositories
- Shifts in the Underground: The Impact of Water Kurita's (Lumma Stealer) Doxxing
- Back to Business: Lumma Stealer Returns with Stealthier Methods
- Lumma Stealer's GitHub-Based Delivery Explored via Managed Detection and Response
- Lumma Infostealer Continues Its GitHub Social Engineering Campaign
Threats related to FakeGit Campaign
- Infostealer Campaigns (Lumma, RedLine, StealC) Harvesting AI Coding Agent and Developer Platform Credentials at Scale
- NVIDIA Releases SkillSpector: Open-Source Security Scanner for AI Agent Skills
- Fake AI Tool Attacks on SMBs: 33,300 Cyberattacks Masquerading as ChatGPT, Copilot, Claude in Early 2026
- Unit 42 — 18 High-Risk GenAI Chrome Extensions Deliver RATs, AitB, Infostealers, and Search Hijackers Targeting AI Users
Detection coverage for TL-2026-1595
As of 2026-07-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1595 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1595
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.