CTI · reviewed · 2026-10-09

FakeGit Campaign: 7,600 Malicious GitHub Repos Pushing SmartLoader/StealC Malware

Full story & timeline

MITRE ATT&CK

• T1608 Stage Capabilities Resource Development
• T1036 Masquerading Stealth
• T1204 User Execution Execution

Indicators

No curated indicators tied to this case.

Detections

No detection content yet — case analysis did not yield signal-specific telemetry. Check back after the next daily CTI pass.

References

• https://www.bleepingcomputer.com/news/security/fakegit-campaign-uses-7-600-github-repos-to-push-smartloader-malware/
• https://any.run/malware-trends/smartloader/?utm_source=twitter&utm_medium=post&utm_campaign=smartloader&utm_term=280926&utm_content=linktomtt
• https://www.bleepingcomputer.com/news/security/fakegit-malware-campaign-returns-with-17-610-malicious-github-repos/
• https://fawkes.rocks/2026/10/08/fakegit-returns-with-17610-malicious-github-repos/
• https://www.it-connect.fr/fakegit-depots-github-smartloader-stealc/