FakeGit campaign returns with 17,610 malicious GitHub repositories

The FakeGit campaign resumed on October 4, using 17,610 GitHub repositories to distribute SmartLoader malware, according to researchers at software supply-chain security platform Apiiro.

Apiiro says the repositories use convincing README instructions and a download button that points to a ZIP archive containing SmartLoader, which can distribute other malware. In 34 hours, the campaign pushed more than 13,000 repositories, reaching a peak of 2,999 per hour. In sampled commits, 97% changed only the README, and 88% directed the download button to a ZIP that installs SmartLoader, the researchers said.

The campaign uses mostly throwaway accounts, though researchers identified at least 700 accounts that appear to belong to legitimate developers. Similar activity with various payloads has been observed since at least January. In July, researchers at Island reported 7,600 fake repositories pushing SmartLoader, including 800 posing as AI skills or MCP servers.

Apiiro says the campaign can persist because blocklists cover only some malicious repositories and backup payloads remain accessible. Researchers found malicious archives in forks, older files, release assets, issue attachments, and separate download-hosting repositories. Apiiro also said 71% of the repositories were missing from URLhaus before its report.

Apiiro recommends checking repository owners and getting AI skills and MCP servers from official registries or vendor repositories. If SmartLoader may have run, it recommends treating the event as a potential GitHub account compromise, revoking active sessions and access tokens, and moving to passkeys.