FakeGit Campaign: 7,600 Malicious GitHub Repos Push SmartLoader and StealC Malware via AI Tool Poisoning (Water Kurita)

FakeGit Campaign (TL-2026-1595), also tracked as FakeGit, is a high-severity malware campaign, first published 2026-07-21. It is attributed to Water Kurita with high confidence, affects GitHub GitHub repository hosting / Release assets, maps to 31 MITRE ATT&CK techniques (T1005, T1027, T1033), and is covered by 9 detection rules and 28 indicators of compromise.

Key facts for TL-2026-1595

Threat ID
TL-2026-1595
Also known as
FakeGit
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-07-21
Last reviewed
2026-07-21
Attribution
Water Kurita
Attribution confidence
HIGH
Motivation
FINANCIAL
Target sectors
technology, softwaredevelopment, finance, retail, generaldevelopercommunity
Target regions
Global
Detection rules
9
Indicators of compromise
28

Malware and tooling in FakeGit Campaign

Malware and tooling: Lumma Stealer - S1213, SmartLoader, Stealc, LuaJIT 2.1.0-beta3, Polygon smart contract dead-drop resolver, Prometheus obfuscator

Threat actor Water Kurita operates 'FakeGit', a large-scale campaign using over 7,600 malicious GitHub repositories disguised as AI tools, agents, MCP servers, and cracked software to distribute the LuaJIT-based SmartLoader, which persists via scheduled tasks and delivers the StealC infostealer (previously Lumma Stealer). The novel 'AgentBaiting' technique poisons AI tool registries (LobeHub, Glama, MCP.so, MCP Market) with fabricated documentation so malicious repos surface directly in AI coding-assistant search/install recommendations (demonstrated against Claude Code, Gemini, and ChatGPT), while SmartLoader resolves its C2 endpoint via a Polygon blockchain smart-contract dead-drop.

How FakeGit Campaign works

FakeGit is a large-scale, ongoing malware distribution campaign attributed to Water Kurita, a threat actor Trend Micro also tracks as the operator behind the Lumma Stealer Malware-as-a-Service (MaaS) offering. The actor floods GitHub with fake repositories (over 7,600 cataloged, spanning 103+ accounts in a related 109-repo sub-cluster) that mimic legitimate open-source tools, game cheats, cracked software, cryptocurrency utilities, and — in the campaign's newest and most novel evolution beginning March 2026 and peaking in April 2026 — over 800 fake 'AI Skills' and Model Context Protocol (MCP) servers. Water Kurita uses generative AI to automate convincing README files, fabricated star/download metrics, and lookalike developer profiles, then seeds these into public AI-tool registries (LobeHub, Glama, MCP.so, MCP Market), which frequently reproduce the attacker-authored README verbatim, amplifying reach. Roughly 600+ registry listings and 14,084,688 cumulative measured downloads (across 335 unique GitHub Release assets from 211 repositories) resulted.

The operation's signature innovation is 'AgentBaiting': rather than relying solely on humans clicking malicious links, the attacker crafts repositories so that AI coding agents and chat assistants performing autonomous tool/capability discovery will surface the malicious repo organically and recommend its installation instructions to the end user, without ever being shown a link. Island.io's controlled testing confirmed this works against Anthropic Claude Code (which independently discovered and, in some runs, recommended installation instructions for the malicious repo 'adlaiponderous700/claude-skill-cinematic-prompt'), Google Gemini (which recommended 'DomingosNgongo/walmart-mcp' as its top pick for a 'free Walmart MCP server', a repo confirmed to contain SmartLoader), and OpenAI ChatGPT (which listed the same repository as a top-three, 'best starting point' recommendation). Roughly 62% of AI-themed lures targeted enterprise/developer workflows: Databricks analytics and enterprise data (33%), source-code access via tools like Jenkins CI/CD (25%), and credential/secret harvesting (17%), using lures such as Docker infrastructure helpers and Splunk SOC dashboards.

Victims who follow the README instructions download a ZIP archive embedded deep in the repository's directory structure, disguised as a normal build artifact (e.g., 'project-name-version.zip'). The archive contains a batch launcher, a renamed LuaJIT 2.1.0-beta3 runtime, and an obfuscated Lua payload stored under an innocuous .txt/.log extension; the launcher invokes the runtime via the Windows 'start' command against a GUI-subsystem binary to suppress the console window. The resulting single-line SmartLoader script (~300KB, Prometheus-obfuscated with arithmetic-masked constants, encoded strings, randomized identifiers, and a VM-style dispatcher) fingerprints the host, performs anti-debug checks, captures screenshots via the Windows GDI API, and uses LuaJIT's FFI to declare and call Windows APIs directly, loading follow-on PE payloads reflectively in memory without touching disk.

SmartLoader's command-and-control is blockchain-resilient: it issues a JSON-RPC eth_call to the public Polygon RPC endpoint polygon.drpc.org against a fixed on-chain dead-drop smart contract (0x1823A9a0Ec8e0C25dD957D0841e3D41a4474bAdc, function selector 0x3bc5de30 / getData), which returns an encoded string decoded client-side into the live C2 URL — a bare-IP HTTP endpoint within a single /24 block. This lets the actor rotate takedown-resistant infrastructure at will since the resolver itself (a public, censorship-resistant blockchain) cannot be seized. The malware then POSTs host metadata, fingerprint data, and screenshots as multipart/form-data to /api/<victim_id>, polls for tasking, decrypts server-issued instructions in memory, and reports task completion (typically HTTP 204) to /task/<victim_id>.

SmartLoader's primary follow-on payload is StealC, delivered as an encrypted blob containing a redundant Lua stage plus a packed StealC PE, executed reflectively via SmartLoader's in-memory PE loader from GitHub-hosted encrypted blobs. StealC (first observed late 2022, offered as MaaS in C++) targets browser-stored credentials, session/authentication cookies, FTP client credentials, and cryptocurrency wallets; the current StealC v2 ('Monster V2', $200/month subscription, v2.2.4 as of November 2025) adds a JSON-based C2 protocol, multi-monitor screenshot capture, a unified file grabber, and enhanced session-restoration-file extraction. Persistence is established via two masked Scheduled Tasks disguised as benign software components (e.g., audio managers or Office components) pointing at binaries/Lua stages cached under %LOCALAPPDATA%: one re-executes the cached Lua stage to survive a GitHub repository takedown, and the second re-downloads a fresh encrypted stage from GitHub to recover from local endpoint cleanup.

Water Kurita previously operated the same fake-GitHub-repository delivery model to distribute Lumma Stealer as its own MaaS product. Following a January 2025 law-enforcement takedown that seized over 2,300 Lumma-associated domains, and a subsequent underground doxxing operation against alleged Lumma core members that coincided with a sharp activity decline, the actor pivoted its GitHub-based distribution infrastructure toward SmartLoader + StealC while retaining and refining the generative-AI-assisted repository content pipeline — and, in 2026, extending it into the AI tool/agent ecosystem via AgentBaiting.

MITRE ATT&CK techniques used in TL-2026-1595

Collection

T1005 Data from Local System; T1113 Screen Capture; T1560 Archive Collected Data

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1564 Hide Artifacts; T1620 Reflective Code Loading

Discovery

T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1106 Native API; T1204 User Execution

Persistence

T1053 Scheduled Task/Job; T1547 Boot or Logon Autostart Execution

Command and Control

T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1132 Data Encoding

Initial Access

T1195 Supply Chain Compromise; T1199 Trusted Relationship; T1566 Phishing

Credential Access

T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores

Resource Development

T1583 Acquire Infrastructure; T1585 Establish Accounts; T1587 Develop Capabilities

Impact

T1657 Financial Theft

Affected products and versions in FakeGit Campaign

  • GitHub — GitHub repository hosting / Release assets
    Vulnerable versions: N/A - platform abuse, not a software vulnerability
  • LobeHub — LobeHub AI tool/agent registry
    Vulnerable versions: N/A - registry abuse via listing poisoning
  • Glama — Glama MCP server registry
    Vulnerable versions: N/A - registry abuse via listing poisoning
  • MCP.so — MCP.so registry
    Vulnerable versions: N/A - registry abuse via listing poisoning
  • MCP Market — MCP Market registry
    Vulnerable versions: N/A - registry abuse via listing poisoning
  • Anthropic — Claude Code
    Vulnerable versions: Autonomous Skill/tool discovery feature - version-agnostic behavioral susceptibility
  • Google — Gemini (AI assistant/coding agent)
    Vulnerable versions: Autonomous capability search/recommendation feature - version-agnostic behavioral susceptibility
  • OpenAI — ChatGPT
    Vulnerable versions: Autonomous capability search/recommendation feature - version-agnostic behavioral susceptibility
  • Microsoft — Windows (endpoint OS targeted by SmartLoader/StealC)
    Vulnerable versions: All supported Windows versions

Remediation for FakeGit Campaign

Immediate actions

  • Block outbound HTTP connections to bare-IP endpoints (no reverse DNS/hostname) outside approved allowlists, particularly within the flagged /24 block used for SmartLoader C2
  • Alert on and block non-browser JSON-RPC calls to polygon.drpc.org and other public blockchain RPC endpoints from developer/engineering workstations
  • Hunt for unsigned LuaJIT (lua51.dll / luajit.exe) binaries or renamed LuaJIT runtimes launched via batch files with .txt/.log arguments from user-writable paths (%TEMP%, %LOCALAPPDATA%, Downloads)
  • Audit Scheduled Tasks for entries masquerading as audio managers, Office components, or other benign software pointing at binaries under %LOCALAPPDATA%
  • Revoke and rotate browser sessions, OAuth grants, API tokens, and cloud credentials on any host suspected of StealC execution — session theft, not just passwords, is the primary risk
  • Block/quarantine known malicious repository and package hashes (SHA-256 IOCs) at endpoint and network egress control points

Workarounds

  • Disable autonomous/unattended tool discovery features in AI coding assistants (Claude Code, Gemini, ChatGPT) for environments handling sensitive credentials or production data; require human review of any AI-agent-suggested installation instructions
  • Reject any GitHub release asset/ZIP that embeds an executable, batch launcher, or renamed script-runtime deep within nested directory structures disguised as build artifacts

Longer-term hardening

  • Maintain a curated, reviewed catalog of approved AI Skills/MCP servers for use by AI coding agents rather than allowing open, autonomous discovery of third-party capabilities
  • Require isolated/sandboxed evaluation of any newly discovered Skill, MCP server, or GitHub tool before granting it credentials or production data access
  • Implement publisher/developer verification workflows for registries (LobeHub, Glama, MCP.so, MCP Market) beyond simple listing acceptance, including detection of one-character-off lookalike usernames
  • Deploy agent-activity monitoring to track AI-agent-initiated git clones, package installs, and Skill/MCP directory changes as a distinct telemetry stream
  • Maintain an inventory of approved source repositories, pinned commits, package versions, and expected file hashes to enable rapid IOC matching against future campaign waves

Timeline of FakeGit Campaign

  • Law enforcement seizes over 2,300 domains associated with Water Kurita's Lumma Stealer MaaS operation, disrupting the group's GitHub-based delivery infrastructure.
  • Trend Micro reports Lumma Stealer's return with stealthier delivery methods, indicating Water Kurita rebuilt distribution capability post-takedown.
  • Underground doxxing operation exposes alleged Water Kurita/Lumma Stealer core members, coinciding with a sharp decline in observed group activity.
  • Water Kurita introduces AI-themed lures into the FakeGit campaign, beginning the pivot toward fake AI Skills and MCP server repositories.
  • FakeGit campaign activity peaks with approximately 300 AI-themed repositories created in the month, alongside continued non-AI lures (game cheats, cracked software).
  • Security researchers identify a 109-repository sub-cluster across 103 GitHub accounts distributing SmartLoader and StealC via the Polygon smart-contract C2 mechanism.
  • Trend Micro publishes research formally attributing the AI-assisted fake GitHub repository campaign (SmartLoader + Lumma Stealer distribution lineage) to Water Kurita.
  • Island.io publishes AgentBaiting research demonstrating that Claude Code, Gemini, and ChatGPT autonomously surfaced and recommended malicious FakeGit repositories during capability-discovery tasks.
  • BleepingComputer reports the full scale of the FakeGit campaign: 7,600 malicious GitHub repositories, 14M+ cumulative downloads, and 600+ AI registry listings across LobeHub, Glama, MCP.so, and MCP Market.

Sources cited for FakeGit Campaign

Threats related to FakeGit Campaign

Detection coverage for TL-2026-1595

As of 2026-07-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1595 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-1595

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats