FakeGit Campaign Abuses 7,600 GitHub Repos for Malware

A sophisticated cyber operation named 'FakeGit' has been identified, leveraging approximately 7,600 compromised GitHub repositories to distribute malicious software. These repositories have collectively amassed over 14 million downloads, indicating a significant reach and potential impact.

The primary payloads distributed through this campaign are SmartLoader and StealC malware. SmartLoader is designed to establish persistence on infected systems and download additional malicious modules, while StealC is a data-stealing Trojan capable of exfiltrating sensitive information. Security researchers from Palo Alto Networks' Unit 42 first observed this campaign in late 2023 and have been tracking its evolution.

The attackers behind FakeGit employ deceptive tactics, creating repositories that mimic legitimate software projects or development tools. They often use popular keywords and trending topics to attract developers and users, encouraging them to clone or download the malicious code. The malware is typically embedded within seemingly harmless code or scripts, making detection more challenging.

Analysis of the campaign reveals a persistent and evolving threat. The sheer volume of repositories and the high download count suggest a well-resourced and organized threat actor. The use of GitHub, a platform widely trusted by developers, amplifies the campaign's effectiveness by exploiting the platform's inherent popularity and accessibility within the software development community. The ongoing nature of this operation necessitates increased vigilance from users and enhanced security measures from platform providers.