# FakeGit Campaign: 7,600 Malicious GitHub Repos Push SmartLoader and StealC Malware via AI Tool Poisoning (Water Kurita)

> Threat actor Water Kurita operates 'FakeGit', a large-scale campaign using over 7,600 malicious GitHub repositories disguised as AI tools, agents, MCP servers, and cracked software to distribute the LuaJIT-based SmartLoader, which persists via scheduled tasks and delivers the StealC infostealer (previously Lumma Stealer). The novel 'AgentBaiting' technique poisons AI tool registries (LobeHub, Glama, MCP.so, MCP Market) with fabricated documentation so malicious repos surface directly in AI coding-assistant search/install recommendations (demonstrated against Claude Code, Gemini, and ChatGPT), while SmartLoader resolves its C2 endpoint via a Polygon blockchain smart-contract dead-drop.

- **Published:** 2026-07-21T00:00:00Z
- **Last reviewed:** 2026-10-09T03:24:41.959Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1595
- **ID:** TL-2026-1595
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Water Kurita
- **Detections:** 9 · **IOCs:** 37 (full data via the Threadlinqs MCP server — Purple tier)

## Description

FakeGit is a large-scale, ongoing malware distribution campaign attributed to Water Kurita, a threat actor Trend Micro also tracks as the operator behind the Lumma Stealer Malware-as-a-Service (MaaS) offering. The actor floods GitHub with fake repositories (over 7,600 cataloged, spanning 103+ accounts in a related 109-repo sub-cluster) that mimic legitimate open-source tools, game cheats, cracked software, cryptocurrency utilities, and — in the campaign's newest and most novel evolution beginning March 2026 and peaking in April 2026 — over 800 fake 'AI Skills' and Model Context Protocol (MCP) servers. Water Kurita uses generative AI to automate convincing README files, fabricated star/download metrics, and lookalike developer profiles, then seeds these into public AI-tool registries (LobeHub, Glama, MCP.so, MCP Market), which frequently reproduce the attacker-authored README verbatim, amplifying reach. Roughly 600+ registry listings and 14,084,688 cumulative measured downloads (across 335 unique GitHub Release assets from 211 repositories) resulted.

The operation's signature innovation is 'AgentBaiting': rather than relying solely on humans clicking malicious links, the attacker crafts repositories so that AI coding agents and chat assistants performing autonomous tool/capability discovery will surface the malicious repo organically and recommend its installation instructions to the end user, without ever being shown a link. Island.io's controlled testing confirmed this works against Anthropic Claude Code (which independently discovered and, in some runs, recommended installation instructions for the malicious repo 'adlaiponderous700/claude-skill-cinematic-prompt'), Google Gemini (which recommended 'DomingosNgongo/walmart-mcp' as its top pick for a 'free Walmart MCP server', a repo confirmed to contain SmartLoader), and OpenAI ChatGPT (which listed the same repository as a top-three, 'best starting point' recommendation). Roughly 62% of AI-themed lures targeted enterprise/developer workflows: Databricks analytics and enterprise data (33%), source-code access via tools like Jenkins CI/CD (25%), and credential/secret harvesting (17%), using lures such as Docker infrastructure helpers and Splunk SOC dashboards.

Victims who follow the README instructions download a ZIP archive embedded deep in the repository's directory structure, disguised as a normal build artifact (e.g., 'project-name-version.zip'). The archive contains a batch launcher, a renamed LuaJIT 2.1.0-beta3 runtime, and an obfuscated Lua payload stored under an innocuous .txt/.log extension; the launcher invokes the runtime via the Windows 'start' command against a GUI-subsystem binary to suppress the console window. The resulting single-line SmartLoader script (~300KB, Prometheus-obfuscated with arithmetic-masked constants, encoded strings, randomized identifiers, and a VM-style dispatcher) fingerprints the host, performs anti-debug checks, captures screenshots via the Windows GDI API, and uses LuaJIT's FFI to declare and call Windows APIs directly, loading follow-on PE payloads reflectively in memory without touching disk.

SmartLoader's command-and-control is blockchain-resilient: it issues a JSON-RPC eth_call to the public Polygon RPC endpoint polygon.drpc.org against a fixed on-chain dead-drop smart contract (0x1823A9a0Ec8e0C25dD957D0841e3D41a4474bAdc, function selector 0x3bc5de30 / getData), which returns an encoded string decoded client-side into the live C2 URL — a bare-IP HTTP endpoint within a single /24 block. This lets the actor rotate takedown-resistant infrastructure at will since the resolver itself (a public, censorship-resistant blockchain) cannot be seized. The malware then POSTs host metadata, fingerprint data, and screenshots as multipart/form-data to /api/<victim_id>, polls for tasking, decrypts server-issued instructions in memory, and reports task completion (typically HTTP 204) to /task/<victim_id>.

SmartLoader's primary follow-on payload is StealC, delivered as an encrypted blob containing a redundant Lua stage plus a packed StealC PE, executed reflectively via SmartLoader's in-memory PE loader from GitHub-hosted encrypted blobs. StealC (first observed late 2022, offered as MaaS in C++) targets browser-stored credentials, session/authentication cookies, FTP client credentials, and cryptocurrency wallets; the current StealC v2 ('Monster V2', $200/month subscription, v2.2.4 as of November 2025) adds a JSON-based C2 protocol, multi-monitor screenshot capture, a unified file grabber, and enhanced session-restoration-file extraction. Persistence is established via two masked Scheduled Tasks disguised as benign software components (e.g., audio managers or Office components) pointing at binaries/Lua stages cached under %LOCALAPPDATA%: one re-executes the cached Lua stage to survive a GitHub repository takedown, and the second re-downloads a fresh encrypted stage from GitHub to recover from local endpoint cleanup.

Water Kurita previously operated the same fake-GitHub-repository delivery model to distribute Lumma Stealer as its own MaaS product. Following a January 2025 law-enforcement takedown that seized over 2,300 Lumma-associated domains, and a subsequent underground doxxing operation against alleged Lumma core members that coincided with a sharp activity decline, the actor pivoted its GitHub-based distribution infrastructure toward SmartLoader + StealC while retaining and refining the generative-AI-assisted repository content pipeline — and, in 2026, extending it into the AI tool/agent ecosystem via AgentBaiting.

## MITRE ATT&CK

- T1587 Develop Capabilities
- T1585 Establish Accounts
- T1583 Acquire Infrastructure
- T1566 Phishing
- T1195 Supply Chain Compromise
- T1199 Trusted Relationship
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1106 Native API
- T1053 Scheduled Task/Job
- T1053 Scheduled Task/Job
- T1547 Boot or Logon Autostart Execution
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1497 Virtualization/Sandbox Evasion
- T1564 Hide Artifacts
- T1082 System Information Discovery
- T1057 Process Discovery
- T1033 System Owner/User Discovery
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1113 Screen Capture
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1105 Ingress Tool Transfer
- T1071 Application Layer Protocol
- T1102 Web Service
- T1132 Data Encoding
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft
- T1586.003 Compromise Accounts
- T1608.001 Stage Capabilities
- T1059.003 Command and Scripting Interpreter
- T1055 Process Injection

## Sources

- [FakeGit campaign uses 7,600 GitHub repos to push SmartLoader malware](https://www.bleepingcomputer.com/news/security/fakegit-campaign-uses-7-600-github-repos-to-push-smartloader-malware/)
- [AI Assisted Fake GitHub Repositories Fuel SmartLoader and LummaStealer Distribution](https://www.trendmicro.com/en_us/research/25/c/ai-assisted-fake-github-repositories.html)
- [AgentBaiting: How Fake AI Skills and MCP Servers Delivered Malware](https://www.island.io/blog/agentbaiting-how-800-fake-ai-skills-and-mcp-servers-delivered-malware)
- [AgentBaiting Uses Fake AI Skills and MCP Servers to Deliver SmartLoader and StealC Malware](https://gbhackers.com/agentbaiting-uses-fake-ai-skills/)
- [AgentBaiting: FakeGit Weaponizes 800+ Fake AI Skills for SmartLoader](https://www.technadu.com/agentbaiting-fake-ai-skills-trick-claude-code-gemini-and-chatgpt-into-spreading-malware/631621/)
- [FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware](https://thehackernews.com/2026/07/fakegit-campaign-uses-7600-github.html)
- [Active Exploitation Alert: FakeGit Campaign Abuses 7,600 GitHub Repositories to Distribute SmartLoader and Lumma Stealer Malware via Open-Source Supply Chain](https://www.rescana.com/post/active-exploitation-alert-fakegit-campaign-abuses-7-600-github-repositories-to-distribute-smartloader-and-lumma-stealer)
- [109 Fake GitHub Repos Spread SmartLoader, StealC Malware](https://gbhackers.com/109-fake-github-repos/)
- [Cloned, Loaded, and Stolen: How 109 Fake GitHub Repositories Delivered SmartLoader and StealC](https://hexastrike.com/resources/blog/threat-intelligence/cloned-loaded-and-stolen-how-109-fake-github-repositories-delivered-smartloader-and-stealc/)
- [109 Fake GitHub Repositories Used to Deliver SmartLoader and StealC Malware](https://www.cryptika.com/109-fake-github-repositories-used-to-deliver-smartloader-and-stealc-malware/)
- [SmartLoader & StealC Campaign: Blockchain C2 and Fraudulent GitHub Repositories](https://www.planetjon.net/news/cybersecurity/smartloader-stealc-campaign-blockchain-c2-and-fraudulent-github-repositories/)
- [Shifts in the Underground: The Impact of Water Kurita's (Lumma Stealer) Doxxing](https://www.trendmicro.com/en_gb/research/25/j/the-impact-of-water-kurita-lumma-stealer-doxxing.html)
- [Back to Business: Lumma Stealer Returns with Stealthier Methods](https://www.trendmicro.com/en_us/research/25/g/lumma-stealer-returns.html)
- [Lumma Stealer's GitHub-Based Delivery Explored via Managed Detection and Response](https://www.trendmicro.com/en_us/research/25/a/lumma-stealers-github-based-delivery-via-mdr.html)
- [Lumma Infostealer Continues Its GitHub Social Engineering Campaign](https://www.picussecurity.com/resource/blog/lumma-infostealer-continues-its-github-social-engineering-campaign)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1595