The FakeGit malware campaign has resumed operations with over 17,000 malicious repositories on GitHub, distributing SmartLoader malware that can deploy additional threats. Researchers from Apiiro discovered the campaign reactivated on October 4, adding more than 13,000 repositories in just 34 hours. The attack uses convincing README files with download buttons linking to infected ZIP files. While most accounts involved are disposable, at least 700 accounts belonging to legitimate developers have been compromised and repurposed for the campaign.
Security experts attribute the campaign’s persistence to limitations in removal efforts and the attackers’ ability to redirect downloads while keeping repositories active. Malicious files are distributed across multiple locations including repository forks, release assets, and issue attachments, making deletion ineffective. Researchers recommend users verify repository ownership before downloading, use official registries for AI tools, and treat any SmartLoader execution as a potential account compromise requiring immediate session revocation and token resets.
Source: Read the full story at BleepingComputer
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
