Actor Profile

FakeGit is a threat actor conducting a large-scale supply chain attack campaign targeting software developers through malicious GitHub repositories. The actor's motivation appears to be widespread malware distribution, leveraging the trust developers place in GitHub as a legitimate code-sharing platform. By creating approximately 7,600 compromised repositories that accumulated over 14 million downloads, FakeGit demonstrates sophisticated understanding of developer workflows and supply chain attack vectors. The operation's scale suggests a well-resourced actor with automation capabilities for repository creation and maintenance.

TTPs (Tactics, Techniques, Procedures)

The FakeGit campaign employs supply chain compromise tactics by weaponizing GitHub's trusted infrastructure. Key TTPs include: initial access through malicious code repositories masquerading as legitimate development tools or libraries (T1195.001 - Compromise Software Dependencies and Development Tools); delivery of SmartLoader, which likely serves as a first-stage loader for additional payloads; deployment of StealC information-stealing malware designed to exfiltrate credentials and sensitive data (T1555 - Credentials from Password Stores, T1005 - Data from Local System); and exploitation of developer trust in open-source platforms to achieve mass distribution. The operation demonstrates persistence through maintaining thousands of repositories and likely employs obfuscation techniques to evade GitHub's security controls.

Targets & Patterns

FakeGit specifically targets the Software Development and Technology sectors, focusing on developers who regularly consume open-source code and dependencies from GitHub. This targeting is strategic: developers often have elevated privileges, access to proprietary source code, internal systems, and production environments. Compromising developer machines provides attackers with potential access to intellectual property, credentials for cloud services and repositories, CI/CD pipelines, and downstream supply chain opportunities. The massive scale (14 million downloads) suggests indiscriminate targeting within these sectors rather than specific organizations, indicating the actor seeks broad access for credential harvesting, data theft, or establishing footholds for future operations.

Historical Context

The FakeGit campaign represents an evolution in supply chain attacks targeting developer ecosystems, following the pattern established by previous operations such as the SolarWinds compromise, Codecov breach, and various npm/PyPI package poisoning campaigns. The scale of 7,600 malicious repositories significantly exceeds typical typosquatting operations and suggests an industrial approach to supply chain compromise. This campaign aligns with the growing trend of attackers recognizing developers as high-value targets due to their privileged access and the multiplier effect of compromising development environments. The use of SmartLoader and StealC indicates the actor is leveraging established commodity malware rather than custom tooling, potentially suggesting a cybercrime motivation focused on credential theft and data exfiltration for financial gain.

Defensive Recommendations

  • Implement strict code review and verification processes for all external dependencies, including manual inspection of GitHub repositories before integration, verification of repository authenticity through official channels, and checking repository age, contributor history, and community engagement metrics
  • Deploy endpoint detection and response (EDR) solutions on developer workstations with specific detection rules for SmartLoader and StealC malware behaviors, including monitoring for suspicious process injection, credential access attempts (T1555), and unusual data staging activities (T1005)
  • Enforce network segmentation to isolate developer environments from production systems and implement egress filtering to detect and block C2 communications associated with information stealers
  • Establish software composition analysis (SCA) and dependency scanning tools in CI/CD pipelines to automatically flag suspicious packages, detect known malware signatures, and alert on newly created or low-reputation repositories
  • Conduct security awareness training specifically focused on supply chain threats, teaching developers to recognize indicators of malicious repositories such as poor documentation, suspicious commit patterns, and requests for unnecessary permissions