FakeGit Campaign Exploits 17,000+ GitHub Repositories to Distribute Malware
The FakeGit malware campaign resurfaced in October 2024 with over 17,610 malicious GitHub repositories distributing SmartLoader malware and StealC infostealer. Threat actors exploited legitimate developer accounts and created convincing fake repositories with README files containing download buttons that delivered malicious ZIP archives. In just 34 hours starting October 4, attackers pushed over 13,000 repositories at a peak rate of 2,999 per hour, targeting AI skills repositories and MCP servers listed in public registries to maximize credibility and infection rates. This incident highlights the growing trend of supply chain attacks targeting developer platforms and AI infrastructure. As organizations increasingly adopt AI-powered development tools and automated deployment pipelines, attackers are exploiting trust relationships in code repositories to bypass traditional security controls and distribute malware at scale.
Kill Chain
