FakeGit Campaign: 7,600 Malicious GitHub Repos Push SmartLoader and StealC Malware via AI Tool Poisoning (Water Kurita) — Threadlinqs Intelligence
As of 2026-07-21, FakeGit Campaign: 7,600 Malicious GitHub Repos Push SmartLoader and StealC Malware via AI Tool Poisoning (Water Kurita) is a high-severity malware threat attributed to Water Kurita, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 28 indicators of compromise.
Threat ID: TL-2026-1595 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Water Kurita · FINANCIAL
Threat actor Water Kurita operates 'FakeGit', a large-scale campaign using over 7,600 malicious GitHub repositories disguised as AI tools, agents, MCP servers, and cracked software to distribute the
FakeGit is a large-scale, ongoing malware distribution campaign attributed to Water Kurita, a threat actor Trend Micro also tracks as the operator behind the Lumma Stealer Malware-as-a-Service (MaaS) offering. The actor floods GitHub with fake repositories (over 7,600 cataloged, spanning 103+ accounts in a related 109-repo sub-cluster) that mimic legitimate open-source tools, game cheats, cracked software, cryptocurrency utilities, and — in the campaign's newest and most novel evolution beginning March 2026 and peaking in April 2026 — over 800 fake 'AI Skills' and Model Context Protocol (MCP) servers. Water Kurita uses generative AI to automate convincing README files, fabricated star/download metrics, and lookalike developer profiles, then seeds these into public AI-tool registries (LobeHub, Glama, MCP.so, MCP Market), which frequently reproduce the attacker-authored README verbatim, amplifying reach. Roughly 600+ registry listings and 14,084,688 cumulative measured downloads (across 335 unique GitHub Release assets from 211 repositories) resulted.
The operation's signature innovation is 'AgentBaiting': rather than relying solely on humans clicking malicious links, the attacker crafts repositories so that AI coding agents and chat assistants performing autonomous tool/capability discovery will surface the malicious repo organically and recommend its installation instructions to the end user, without ever being shown a link. Island.io's controlled testing confirmed this works against Anthropic Claude Code (which independently discovered and, in some runs, recommended installation instructions for the malicious repo 'adlaiponderous700/claude-skill-cinematic-prompt'), Google Gemini (which recommended 'DomingosNgongo/walmart-mcp' as its top pick for a 'free Walmart MCP server', a repo confirmed to contain SmartLoader), and OpenAI ChatGPT (which listed the same repository as a top-three, 'best starting point' recommendation). Roughly 62% of AI-themed lures targeted enterprise/developer workflows: Databricks analytics and enterprise data (33%), source-code access via tools like Jenkins CI/CD (25%), and credential/secret harvesting (17%), using lures such as Docker infrastructure helpers and Splunk SOC dashboards.
Victims who follow the README instructions download a ZIP archive embedded deep in the repository's directory structure, disguised as a normal build artifact (e.g., 'project-name-version.zip'). The archive contains a batch launcher, a renamed LuaJIT 2.1.0-beta3 runtime, and an obfuscated Lua payload stored under an innocuous .txt/.log extension; the launcher invokes the runtime via the Windows 'start' command against a GUI-subsystem binary to suppress the console window. The resulting single-line SmartLoader script (~300KB, Prometheus-obfuscated with arithmetic-masked constants, encoded strings, randomized identifiers, and a VM-style dispatcher) fingerprints the host, performs anti-debug checks, captures screenshots via the Windows GDI API, and uses LuaJIT's FFI to declare and call Windows APIs directly, loading follow-on PE payloads reflectively in memory without touching disk.
SmartLoader's command-and-control is blockchain-resilient: it issues a JSON-RPC eth_call to the public Polygon RPC endpoint polygon.drpc.org against a fixed on-chain dead-drop smart contract (0x1823A9a0Ec8e0C25dD957D0841e3D41a4474bAdc, function selector 0x3bc5de30 / getData), which returns an encoded string decoded client-side into the live C2 URL — a bare-IP HTTP endpoint within a single /24 block. This lets the actor rotate takedown-resistant infrastructure at will since the resolver itself (a public, censorship-resistant blockchain) cannot be seized. The malware then POSTs host metadata, fingerprint data, and screenshots as multipart/form-data to /api/<victim_id>, polls for tasking, decrypts server-issued instructions in memory, and reports task completion (typically HTTP 204) to /task/<victim_id>.
SmartLoader's primary follow-on payload is
Target sectors: technology, softwaredevelopment, finance, retail, generaldevelopercommunity
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 28 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, T1587, T1585, T1583, T1566, T1566, T1195, T1199, T1059, T1204, T1106