# TroyDens — Fake AI Tool Campaign Delivers SmartLoader Info-Stealer via Trojanized GitHub Repos

> Active Malware-as-a-Service infostealer campaign exploiting developer interest in AI tooling by cloning legitimate GitHub repositories and hiding malicious payloads in downloads. The multi-stage SmartLoader (LuaJIT-based, Prometheus + MoonSec V3 obfuscation, lua51.dll side-loading) resolves C2 addresses at runtime via EtherHiding blockchain dead-drop on Polygon smart contracts, then delivers StealC and NodeJS-based infostealers. Targets financial services, banking, and technology organizations in North America, Asia, and Southern Europe.

- **Published:** 2026-08-04T00:00:00Z
- **Last reviewed:** 2026-08-29T15:57:12Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1859
- **ID:** TL-2026-1859
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Water Kurita
- **Detections:** 9 · **IOCs:** 46 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Netskope Threat Labs tracked a MaaS infostealer operation dubbed the 'TroyDens lure factory' (also reported as 'FakeGit' / 'Water Kurita' by Trend Micro and Island). Attackers fork or clone legitimate public GitHub repositories — impersonating AI coding assistants, Claude-related tools, ComfyUI projects, Python security guides, Rust frameworks, MCP servers, and utility projects — then inject a malicious folder containing a ZIP archive. Victims download and run what appears to be a benign tool, triggering the infection chain.

The delivered archive contains a renamed LuaJIT 2.1 interpreter (compiler.exe / Luajit.exe / loader.exe), a LuaJIT runtime DLL (lua51.dll, built with MSYS2/GCC and exposing the luaopen_ffi FFI export), a launcher batch script (Application.bat / Launcher.cmd), and a heavily obfuscated Lua script (gc.txt / Uix.txt). The batch file launches the renamed interpreter, which executes the obfuscated Lua code rather than a conventional executable. Stage 1 is protected with the Prometheus Lua obfuscator (including its Vmify custom-VM module, control-flow flattening, and encrypted string pools); stage 2 uses MoonSec V3. Because the interpreter and the payload are separate and neither looks malicious in isolation, the chain evades automated signature scanning.

SmartLoader is a two-stage (redundant) loader. The first stage collects the victim's public IP, geolocation, timezone and ISP via ip-api.com/json, captures a screenshot, and sends an encrypted beacon to C2. Both loader stages resolve the C2 server address at runtime by querying a Polygon smart contract (0x1823A9a0Ec8e0C25dD957D0841e3D41a4474bAdc) via eth_call JSON-RPC (method selector 0x3bc5de30) through public RPC endpoints (polygon.drpc.org, polygon.publicnode.com, rpc-mainnet.matic.quiknode.pro, polygon-mainnet.gateway.tatum.io, polygon-public.nodies.app). This EtherHiding technique lets operators rotate or redirect all implants by updating a single on-chain value, without rebuilding or redistributing the malware. The smart contract returns the current active C2 domain, used for both screenshots and further payload delivery.

Once C2 is resolved, the second stage downloads additional Lua content and a final information-stealing payload (XOR-encrypted, key ECe6VGLRJum2qYtl79OiOU7aHot7Zhbn) from attacker-controlled GitHub repositories. The final payload is a MaaS infostealer — researchers observed both a NodeJS-based variant and StealC, which StealC reflectively loads in memory as a packed x64 PE. StealC targets browser credentials and cookies, cryptocurrency wallets, and email client data. Persistence is established via scheduled tasks and registry modifications. The loader implements anti-analysis: debugger/anti-tamper checks (halting with 'Tamper Detected'), and time-based sandbox evasion (on suspicion it sleeps for ~29,000 years).

The campaign's scale is large: Hexastrike documented 109 malicious repositories across 103 GitHub accounts; Island/BleepingComputer reported the broader FakeGit infrastructure at roughly 7,600 malicious repositories with ~14 million cumulative download events. Over 800 repositories masqueraded as AI skills or MCP servers and appeared 600+ times in public AI registries (LobeHub, Glama, MCP.so, MCP Market) — a technique dubbed 'agentbaiting' aimed at getting AI agents to recommend the malicious repos. Victims were concentrated in North America, Asia, and Southern Europe, with financial services, banking, and technology sectors leading. Developers are a high-value vector because they hold access to cloud environments, source code, API keys, code-signing certificates, and CI/CD systems.

## MITRE ATT&CK

- T1195.001 Compromise Software Dependencies and Development Tools
- T1204.002 Malicious File
- T1059.003 Windows Command Shell
- T1059.007 JavaScript
- T1059.010 AutoHotKey & AutoIT
- T1053.005 Scheduled Task
- T1547.001 Registry Run Keys / Startup Folder
- T1027.002 Software Packing
- T1140 Deobfuscate/Decode Files or Information
- T1574.001 DLL
- T1055.002 Portable Executable Injection
- T1622 Debugger Evasion
- T1497.003 Time Based Checks
- T1082 System Information Discovery
- T1113 Screen Capture
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1552.004 Private Keys
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography
- T1102.001 Dead Drop Resolver

## Sources

- [Fake AI Tool Campaign Targets Developers with SmartLoader Malware](https://cybersecuritynews.com/fake-ai-tool-campaign/)
- [Developers in the Crosshairs: Fake AI Tools Deliver Infostealer](https://www.netskope.com/blog/developers-in-the-crosshairs-fake-ai-tools-deliver-infostealer)
- [Cloned, Loaded, and Stolen: How 109 Fake GitHub Repositories Delivered SmartLoader and StealC](https://hexastrike.io/cloned-loaded-and-stolen-how-109-fake-github-repositories-delivered-smartloader-and-stealc/)
- [FakeGit campaign uses 7,600 GitHub repos to push SmartLoader malware](https://www.bleepingcomputer.com/news/security/fakegit-campaign-uses-7-600-github-repos-to-push-smartloader-malware/)
- [TroyDens Lure Factory: How 300 Fake GitHub Repos Are Fueling a New Wave of Infostealer Attacks](https://undercodenews.com/troydens-lure-factory-how-300-fake-github-repos-are-fueling-a-new-wave-of-infostealer-attacks/)
- [GitHub Repo Poisoning: SmartLoader Abuses AI & Utility Repos to Deliver StealC](https://jmp-esp.org/github-repo-poisoning-smartloader-abuses-ai-utility-repos-to-deliver-stealc/)
- [Reverse Engineering SmartLoader: Where Commodity Malware and Operational Tooling Diverge](https://www.hakai-security.com/reverse-engineering-smartloader-where-commodity-malware-and-operational-tooling-diverge/)
- [ORKL Library — SmartLoader/StealC (CBZ2BF98)](https://orkl.eu/libraryEntry/cbc2bf98-c092-488f-97c4-e7095850bf31)
- [Fake GitHub Repositories Distribute SmartLoader and StealC Malware](https://www.cirt.gov.jm/advisory/fake-github-repositories-distribute-smartloader-and-stealc-malware-deceptive-open-source)
- [skillscan-rules MAL-082 SmartLoader/StealC pattern update](https://github.com/kurtpayne/skillscan-rules/pull/51)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1859