Actor Profile

FakeGit is a coordinated malware distribution campaign that leverages fake GitHub repositories to deliver multiple malware families. The operation uses a combination of throwaway accounts and approximately 700 compromised legitimate developer accounts to create convincing fake repositories. Active since at least January 2026, the campaign was formally identified and named in July 2026 by Island researchers. The operator's motivation appears to be widespread malware distribution through software supply-chain compromise, exploiting developer trust in GitHub as a legitimate code repository platform. The campaign demonstrates sophisticated infrastructure management, maintaining a pre-existing fleet of repositories that can be rapidly re-purposed with new payloads.

TTPs (Tactics, Techniques, Procedures)

The FakeGit campaign employs supply-chain compromise tactics through malicious GitHub repositories. Key techniques include: Initial Access via malicious repositories masquerading as legitimate projects, particularly AI skills and MCP servers listed in public registries (T1195.001 - Compromise Software Supply Chain). The attack uses social engineering with convincing README files containing download buttons that deliver ZIP archives (T1204.002 - User Execution: Malicious File). SmartLoader serves as the initial payload and loader malware (T1204.002, T1059 - Command and Scripting Interpreter) to distribute secondary payloads including the StealC infostealer (T1555 - Credentials from Password Stores, T1539 - Steal Web Session Cookie). The campaign demonstrates advanced persistence through distributed payload hosting across forks, release assets, issue attachments, and backup repositories, enabling rapid link rotation to evade takedown efforts (T1608.001 - Upload Malware).

Targets & Patterns

The FakeGit campaign targets software developers and organizations that rely on GitHub for code repositories and package management. The operation specifically targets users seeking AI-related tools, with 800 malicious repositories identified masquerading as AI skills or Model Context Protocol (MCP) servers that appeared in public AI registries and catalogs. This targeting pattern exploits the growing adoption of AI development tools and the trust developers place in GitHub as a legitimate platform. The campaign's use of compromised legitimate developer accounts (approximately 700 identified) suggests targeting of the broader developer community to establish credibility. The scale of the operation—17,610 repositories created with peaks of 2,999 repositories per hour—indicates an intent for mass compromise rather than targeted attacks, seeking to maximize victim count across the global developer ecosystem.

Historical Context

The FakeGit campaign has been active since at least January 2026, with the operation formally identified and named in July 2026 when Island researchers published a report documenting 7,600 fake GitHub repositories distributing SmartLoader malware. The campaign went dormant after initial detection but reactivated on October 4, 2026, demonstrating operational resilience. The October reactivation saw rapid escalation, with over 13,000 repositories pushed in just 34 hours. The campaign has evolved its payload distribution, initially focusing on StealC infostealer and later pivoting to SmartLoader as the primary initial payload. Analysis reveals that 71% of the malicious infrastructure was missing from URLhaus threat intelligence feeds before Apiiro's October report, indicating the operation successfully evaded detection mechanisms. The campaign's survival is attributed to its distributed infrastructure approach, with malicious payloads hosted across forks, release assets, and issue attachments, making traditional takedown efforts ineffective as operators simply redirect download links to backup copies.

Defensive Recommendations

  • Implement repository verification controls: validate repository owner authenticity, account age, commit history, and contributor legitimacy before downloading any code or executables from GitHub
  • Restrict AI tool and MCP server installations to official vendor repositories and verified registries only; maintain an allowlist of trusted sources for development tools
  • Deploy endpoint detection rules for SmartLoader and StealC indicators: monitor for ZIP archive execution from GitHub domains, suspicious PowerShell or scripting interpreter activity (T1059), and unauthorized credential access attempts (T1555, T1539)
  • Treat any suspected SmartLoader execution as a GitHub account compromise incident: immediately revoke all active sessions and access tokens, rotate credentials, and migrate to passkey-based authentication
  • Implement network-level monitoring for connections to known SmartLoader C2 infrastructure and establish behavioral analytics to detect mass repository creation patterns or anomalous download activity from GitHub