Cybersecurity researchers at Apiiro have recorded a new surge in activity from the FakeGit malicious campaign on the GitHub platform. According to the specialists, attackers have deployed a massive infrastructure of 17.6 thousand fake repositories used to distribute the SmartLoader downloader. Once installed on a victim's device, this component downloads the StealC stealer—a malware designed to harvest credentials, sessions, and other sensitive data. At the peak of the attack, hackers were updating up to 3,000 projects per hour, relying on both disposable accounts and over 700 compromised accounts belonging to legitimate developers.
Scale and Pace of the Attack
A key feature of the FakeGit campaign highlighted by Apiiro researchers is its industrial pace: at their peak, the attackers generated and updated up to 3,000 malicious projects per hour. This pace is made possible by automation and the use of two types of credentials—disposable accounts for rapid rotation and over 700 hijacked accounts of real developers, which give the fake repositories an appearance of legitimacy. In total, the campaign's network features 17.6 thousand bogus repositories, making it one of the largest operations of its kind on the platform.
How the Infection Scheme Works
The majority of the fake repositories are disguised as popular utilities, AI tools, and MCP servers sourced from public catalogs. The fraudsters place convincing usage instructions and a download button in the README files, which actually leads to a ZIP archive containing malicious executable code. Thus, the victim, following the familiar "download and run" routine, installs the SmartLoader downloader on their device, followed immediately by the StealC stealer.
Bypassing Point-Targeted Blocks
The operation successfully bypasses point-targeted security blocks by repeatedly duplicating bootloader files. Malicious executables are placed not only in the main repositories but also in their forks, ticket attachments, and release assets. This means that even if a single repository is deleted or blocked, the malicious code continues to spread through related platform objects, significantly complicating the campaign's neutralization.
Specialists' Recommendations
Apiiro specialists recommend that developers and GitHub users thoroughly check repository owners before downloading and running any code, paying attention to account age, publication history, and whether the project matches its stated purpose. If device infection is suspected, experts advise immediately revoking active access tokens and sessions to limit potential attacker access to credentials and infrastructure.
