Actor Profile

FakeGit is a threat actor conducting a large-scale supply chain attack campaign targeting the software development community. The actor's motivation centers on mass malware distribution through the compromise of developer trust in the GitHub platform. By creating thousands of malicious repositories disguised as legitimate software projects, FakeGit exploits the open-source ecosystem to deliver SmartLoader and StealC malware. The operation's scale—7,600 repositories generating over 14 million downloads—indicates significant resources and infrastructure dedicated to targeting developers and technology sector personnel. The actor demonstrates sophisticated understanding of developer workflows and supply chain attack vectors.

TTPs (Tactics, Techniques, Procedures)

The FakeGit campaign employs supply chain compromise techniques by hosting malicious code on GitHub, a trusted developer platform. Key TTPs include: Initial Access via malicious repositories masquerading as legitimate open-source projects (T1195.002 - Compromise Software Supply Chain); distribution of SmartLoader, likely functioning as a first-stage loader for additional payloads; deployment of StealC information-stealing malware for credential and data exfiltration (T1555 - Credentials from Password Stores, T1005 - Data from Local System); and exploitation of developer trust in the GitHub ecosystem (T1566.001 - Phishing: Spearphishing Attachment adapted to repository downloads). The massive scale suggests automated repository creation and maintenance infrastructure.

Targets & Patterns

FakeGit specifically targets software developers and technology sector organizations. The choice of GitHub as the distribution platform indicates deliberate targeting of individuals who regularly download and integrate code from open-source repositories into their development environments. This targeting pattern suggests multiple objectives: credential theft from developer workstations that may contain access to production systems, intellectual property theft of proprietary source code, and potential pivot points into corporate networks through compromised developer machines. The technology sector focus aligns with high-value targets possessing sensitive code, API keys, cloud credentials, and access to critical infrastructure. The scale of 14 million downloads indicates both broad targeting and likely automated victim engagement.

Historical Context

The FakeGit campaign represents an evolution in supply chain attacks targeting the software development ecosystem. While the provided data does not include specific historical campaign linkages, this operation follows established patterns of supply chain compromise seen in previous incidents targeting package repositories and open-source platforms. The use of GitHub as an attack vector builds on growing trends of adversaries exploiting trusted developer platforms. The deployment of StealC malware, a known information stealer, suggests potential connections to broader cybercrime ecosystems focused on credential harvesting and initial access brokering. The unprecedented scale of 7,600 malicious repositories indicates this may represent one of the largest GitHub-based malware distribution campaigns documented to date.

Defensive Recommendations

  • Implement GitHub repository vetting procedures including verification of repository age, contributor history, and community engagement metrics before downloading code
  • Deploy endpoint detection and response (EDR) solutions configured to detect SmartLoader and StealC indicators, focusing on monitoring for T1055 (Process Injection) and T1555 (Credentials from Password Stores) behaviors
  • Enforce code signing verification and sandbox analysis for all external code before integration into development environments
  • Monitor developer workstations for unusual outbound connections and data exfiltration patterns, particularly to newly registered or suspicious domains associated with C2 infrastructure
  • Implement network segmentation to isolate developer environments from production systems and enforce least-privilege access controls to limit lateral movement from compromised developer machines