TroyDens — Fake AI Tool Campaign Delivers SmartLoader Info-Stealer via Trojanized GitHub Repos — Threadlinqs Intelligence
As of 2026-08-04, TroyDens — Fake AI Tool Campaign Delivers SmartLoader Info-Stealer via Trojanized GitHub Repos is a high-severity malware threat attributed to Water Kurita, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 46 indicators of compromise.
Threat ID: TL-2026-1859 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Water Kurita · FINANCIAL
Active Malware-as-a-Service infostealer campaign exploiting developer interest in AI tooling by cloning legitimate GitHub repositories and hiding malicious payloads in downloads. The multi-stage
Netskope Threat Labs tracked a MaaS infostealer operation dubbed the 'TroyDens lure factory' (also reported as 'FakeGit' / 'Water Kurita' by Trend Micro and Island). Attackers fork or clone legitimate public GitHub repositories — impersonating AI coding assistants, Claude-related tools, ComfyUI projects, Python security guides, Rust frameworks, MCP servers, and utility projects — then inject a malicious folder containing a ZIP archive. Victims download and run what appears to be a benign tool, triggering the infection chain.
The delivered archive contains a renamed LuaJIT 2.1 interpreter (compiler.exe / Luajit.exe / loader.exe), a LuaJIT runtime DLL (lua51.dll, built with MSYS2/GCC and exposing the luaopen_ffi FFI export), a launcher batch script (Application.bat / Launcher.cmd), and a heavily obfuscated Lua script (gc.txt / Uix.txt). The batch file launches the renamed interpreter, which executes the obfuscated Lua code rather than a conventional executable. Stage 1 is protected with the Prometheus Lua obfuscator (including its Vmify custom-VM module, control-flow flattening, and encrypted string pools); stage 2 uses MoonSec V3. Because the interpreter and the payload are separate and neither looks malicious in isolation, the chain evades automated signature scanning.
SmartLoader is a two-stage (redundant) loader. The first stage collects the victim's public IP, geolocation, timezone and ISP via ip-api.com/json, captures a screenshot, and sends an encrypted beacon to C2. Both loader stages resolve the C2 server address at runtime by querying a Polygon smart contract (0x1823A9a0Ec8e0C25dD957D0841e3D41a4474bAdc) via eth_call JSON-RPC (method selector 0x3bc5de30) through public RPC endpoints (polygon.drpc.org, polygon.publicnode.com, rpc-mainnet.matic.quiknode.pro, polygon-mainnet.gateway.tatum.io, polygon-public.nodies.app). This EtherHiding technique lets operators rotate or redirect all implants by updating a single on-chain value, without rebuilding or redistributing the malware. The smart contract returns the current active C2 domain, used for both screenshots and further payload delivery.
Once C2 is resolved, the second stage downloads additional Lua content and a final information-stealing payload (XOR-encrypted, key ECe6VGLRJum2qYtl79OiOU7aHot7Zhbn) from attacker-controlled GitHub repositories. The final payload is a MaaS infostealer — researchers observed both a NodeJS-based variant and StealC, which StealC reflectively loads in memory as a packed x64 PE. StealC targets browser credentials and cookies, cryptocurrency wallets, and email client data. Persistence is established via scheduled tasks and registry modifications. The loader implements anti-analysis: debugger/anti-tamper checks (halting with 'Tamper Detected'), and time-based sandbox evasion (on suspicion it sleeps for ~29,000 years).
The campaign's scale is large: Hexastrike documented 109 malicious repositories across 103 GitHub accounts; Island/BleepingComputer reported the broader FakeGit infrastructure at roughly 7,600 malicious repositories with ~14 million cumulative download events. Over 800 repositories masqueraded as AI skills or MCP servers and appeared 600+ times in public AI registries (LobeHub, Glama, MCP.so, MCP Market) — a technique dubbed 'agentbaiting' aimed at getting AI agents to recommend the malicious repos. Victims were concentrated in North America, Asia, and Southern Europe, with financial services, banking, and technology sectors leading. Developers are a high-value vector because they hold access to cloud environments, source code, API keys, code-signing certificates, and CI/CD systems.
Target sectors: finance, banking, technology, software-development
Target regions: North America, Asia, 039 - Southern Europe
Detections & IOCs
As of 2026-08-17, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 46 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
3 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, T1195.001, T1204.002, T1059.003, T1059.007, T1059.010, T1053.005, T1547.001, T1027.002, T1140, T1574.001
