Threat reportMalwareTL-2026-1859
TroyDens — Fake AI Tool Campaign Delivers SmartLoader Info-Stealer via Trojanized GitHub Repos
TroyDens — Fake AI Tool Campaign Delivers SmartLoader (TL-2026-1859), also tracked as FakeGit, is a high-severity malware campaign, first published 2026-08-04 and last reviewed 2026-08-29. It is attributed to Water Kurita with medium confidence, maps to 21 MITRE ATT&CK techniques (T1027.002, T1053.005, T1055.002), and is covered by 9 detection rules and 46 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 21MITRE ATT&CK
- Actors
- 1Water Kurita
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 46Indicators of compromise
Key facts for TL-2026-1859
- Threat ID
- TL-2026-1859
- Also known as
- FakeGit, TroyDen's Lure Factory, Developers in the Crosshairs
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- Water Kurita
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- finance, banking, technology, software-development
- Target regions
- North America, Asia, 039 - Southern Europe
- Detection rules
- 9
- Indicators of compromise
- 46
- Updates
- 2026-08-29
Malware and tooling in TroyDens — Fake AI Tool Campaign Delivers SmartLoader
Malware and tooling: NodeJS infostealer, Prometheus, SmartLoader, Stealc, 0x1823A9a0Ec8e0C25dD957D0841e3D41a4474bAdc, 0x3bc5de30, LuaJIT, MoonSec V3, Prometheus
How TroyDens — Fake AI Tool Campaign Delivers SmartLoader works
Active Malware-as-a-Service infostealer campaign exploiting developer interest in AI tooling by cloning legitimate GitHub repositories and hiding malicious payloads in downloads. The multi-stage SmartLoader (LuaJIT-based, Prometheus + MoonSec V3 obfuscation, lua51.dll side-loading) resolves C2 addresses at runtime via EtherHiding blockchain dead-drop on Polygon smart contracts, then delivers StealC and NodeJS-based infostealers. Targets financial services, banking, and technology organizations in North America, Asia, and Southern Europe.
Netskope Threat Labs tracked a MaaS infostealer operation dubbed the 'TroyDens lure factory' (also reported as 'FakeGit' / 'Water Kurita' by Trend Micro and Island). Attackers fork or clone legitimate public GitHub repositories — impersonating AI coding assistants, Claude-related tools, ComfyUI projects, Python security guides, Rust frameworks, MCP servers, and utility projects — then inject a malicious folder containing a ZIP archive. Victims download and run what appears to be a benign tool, triggering the infection chain.
The delivered archive contains a renamed LuaJIT 2.1 interpreter (compiler.exe / Luajit.exe / loader.exe), a LuaJIT runtime DLL (lua51.dll, built with MSYS2/GCC and exposing the luaopen_ffi FFI export), a launcher batch script (Application.bat / Launcher.cmd), and a heavily obfuscated Lua script (gc.txt / Uix.txt). The batch file launches the renamed interpreter, which executes the obfuscated Lua code rather than a conventional executable. Stage 1 is protected with the Prometheus Lua obfuscator (including its Vmify custom-VM module, control-flow flattening, and encrypted string pools); stage 2 uses MoonSec V3. Because the interpreter and the payload are separate and neither looks malicious in isolation, the chain evades automated signature scanning.
SmartLoader is a two-stage (redundant) loader. The first stage collects the victim's public IP, geolocation, timezone and ISP via ip-api.com/json, captures a screenshot, and sends an encrypted beacon to C2. Both loader stages resolve the C2 server address at runtime by querying a Polygon smart contract (0x1823A9a0Ec8e0C25dD957D0841e3D41a4474bAdc) via eth_call JSON-RPC (method selector 0x3bc5de30) through public RPC endpoints (polygon.drpc.org, polygon.publicnode.com, rpc-mainnet.matic.quiknode.pro, polygon-mainnet.gateway.tatum.io, polygon-public.nodies.app). This EtherHiding technique lets operators rotate or redirect all implants by updating a single on-chain value, without rebuilding or redistributing the malware. The smart contract returns the current active C2 domain, used for both screenshots and further payload delivery.
Once C2 is resolved, the second stage downloads additional Lua content and a final information-stealing payload (XOR-encrypted, key ECe6VGLRJum2qYtl79OiOU7aHot7Zhbn) from attacker-controlled GitHub repositories. The final payload is a MaaS infostealer — researchers observed both a NodeJS-based variant and StealC, which StealC reflectively loads in memory as a packed x64 PE. StealC targets browser credentials and cookies, cryptocurrency wallets, and email client data. Persistence is established via scheduled tasks and registry modifications. The loader implements anti-analysis: debugger/anti-tamper checks (halting with 'Tamper Detected'), and time-based sandbox evasion (on suspicion it sleeps for ~29,000 years).
The campaign's scale is large: Hexastrike documented 109 malicious repositories across 103 GitHub accounts; Island/BleepingComputer reported the broader FakeGit infrastructure at roughly 7,600 malicious repositories with ~14 million cumulative download events. Over 800 repositories masqueraded as AI skills or MCP servers and appeared 600+ times in public AI registries (LobeHub, Glama, MCP.so, MCP Market) — a technique dubbed 'agentbaiting' aimed at getting AI agents to recommend the malicious repos. Victims were concentrated in North America, Asia, and Southern Europe, with financial services, banking, and technology sectors leading. Developers are a high-value vector because they hold access to cloud environments, source code, API keys, code-signing certificates, and CI/CD systems.
MITRE ATT&CK techniques used in TL-2026-1859
Defense Evasion
T1027.002 Software Packing; T1055.002 Portable Executable Injection; T1140 Deobfuscate/Decode Files or Information; T1497.003 Time Based Checks; T1622 Debugger Evasion
Persistence
T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder
Execution
T1059.003 Windows Command Shell; T1059.007 JavaScript; T1059.010 AutoHotKey & AutoIT; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1102.001 Dead Drop Resolver; T1573.001 Symmetric Cryptography
Discovery
T1082 System Information Discovery
Collection
Initial Access
T1195.001 Compromise Software Dependencies and Development Tools
Credential Access
T1539 Steal Web Session Cookie; T1552.004 Private Keys; T1555.003 Credentials from Web Browsers
stealth
Remediation for TroyDens — Fake AI Tool Campaign Delivers SmartLoader
Immediate actions
- Block known C2 IPs and domains at the perimeter (213.176.72.200, 213.176.73.149, 144.31.57.65/67, 85.209.129.2, 89.169.12.160/241, 217.119.129.76)
- Hunt for and remove scheduled tasks and registry Run keys created by SmartLoader
- Rotate all secrets and credentials on any environment where SmartLoader execution is suspected
- Block or quarantine the listed malicious GitHub repositories and accounts
Workarounds
- Verify project ownership, contributor history, and official release sources before running GitHub-hosted installers
- Run downloaded AI tools in isolated environments (VM/sandbox) before use on production systems
Longer-term hardening
- Deploy EDR with behavioral detection for LuaJIT/side-loading and blockchain RPC traffic from script interpreters
- Apply application control to limit unsigned interpreters and script launchers outside approved directories
- Maintain an approved catalog of skills and MCP servers; test new AI capabilities in isolated environments
- Monitor for unusual Polygon RPC traffic, raw GitHub downloads, and unexpected screenshot capture
Timeline of TroyDens — Fake AI Tool Campaign Delivers SmartLoader
- Earliest ZIP file timestamps observed across the fake repositories, indicating the start of payload staging.
- Island researchers observed the first significant shift toward AI-themed repositories (AI assistants, automated coding tools).
- jmp-esp.org published analysis of SmartLoader abusing AI and utility repos to deliver StealC via Prometheus obfuscation and EtherHiding.
- Latest ZIP file timestamps across the fake repositories, closing the early staging window.
- Decrypted StealC binary compiled (PE timestamp 20:06 UTC), ~12 minutes before its staging repository was created.
- Hexastrike identified 109 malicious repositories across 103 GitHub accounts; SmartLoader C2 addresses (144.31.57.65/67) last seen.
- Hexastrike published 'Cloned, Loaded, and Stolen' detailing the SmartLoader + StealC delivery chain and Polygon-contract C2 resolution.
- Campaign reached its peak, with over 300 AI-related repositories created in a single month and agentbaiting targeting MCP registries.
- skillscan-rules MAL-082 SmartLoader/StealC detection pattern updated on GitHub.
- Netskope Threat Labs published 'Developers in the Crosshairs' documenting the multi-stage SmartLoader chain (Prometheus + MoonSec V3) and EtherHiding on Polygon.
- Island and BleepingComputer reported the broader FakeGit scale: ~7,600 malicious repositories and ~14 million cumulative download events.
- Malicious GitHub account 'yawalinte' created (hosted second-stage payload content); reported for takedown.
- Malicious GitHub account 'JuliusMAAR' created (hosted identical payload content); reported for takedown.
- Cyber Security News article published bringing the campaign to broader public attention.
Update history for TL-2026-1859
- 2026-08-29 — tweetfeed.live community intel: New TL_OSINT_Scan community intel: 1 newly-corroborated indicator(s), 3 community-related indicator(s).
Sources cited for TroyDens — Fake AI Tool Campaign Delivers SmartLoader
- Fake AI Tool Campaign Targets Developers with SmartLoader Malware
- Developers in the Crosshairs: Fake AI Tools Deliver Infostealer
- Cloned, Loaded, and Stolen: How 109 Fake GitHub Repositories Delivered SmartLoader and StealC
- FakeGit campaign uses 7,600 GitHub repos to push SmartLoader malware
- TroyDens Lure Factory: How 300 Fake GitHub Repos Are Fueling a New Wave of Infostealer Attacks
- GitHub Repo Poisoning: SmartLoader Abuses AI & Utility Repos to Deliver StealC
- Reverse Engineering SmartLoader: Where Commodity Malware and Operational Tooling Diverge
- ORKL Library — SmartLoader/StealC (CBZ2BF98)
- Fake GitHub Repositories Distribute SmartLoader and StealC Malware
- skillscan-rules MAL-082 SmartLoader/StealC pattern update
Detection coverage for TL-2026-1859
As of 2026-08-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1859 across Splunk SPL, Microsoft KQL and Sigma, covering 46 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1859
4 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.