A massive operation called FakeGit has weaponized over 7,600 GitHub repositories to distribute SmartLoader and StealC malware, accumulating more than 14 million downloads across the platform.
The FakeGit campaign represents a significant threat to developers relying on GitHub for code repositories. Threat researchers identified the operation after discovering thousands of malicious repositories designed to appear legitimate while delivering infostealer and loader malware.
SmartLoader and StealC are both dangerous malware families. SmartLoader functions as a modular downloader capable of executing arbitrary code and deploying additional threats. StealC operates as an infostealer, harvesting sensitive credentials and data from infected systems.
The sheer scale of this campaign underscores GitHub's vulnerability to abuse. With 7,600 repositories and 14 million downloads, the attackers achieved significant distribution before detection. The repositories likely used obfuscation techniques, misleading descriptions, or impersonation tactics to bypass security controls and trick developers into downloading infected code.
This incident follows a pattern of growing supply chain attacks targeting development platforms. Attackers recognize that compromising repositories reaches a wide audience of developers and organizations that trust these sources. Each infected download extends the malware's reach into corporate networks and development environments.
GitHub has since removed the malicious repositories from its platform. However, users who downloaded code from these repositories during the campaign's operation may face infection risks. Developers should audit their dependencies and recent downloads, particularly from newly created or unfamiliar accounts.
The campaign highlights the importance of repository verification practices. Developers should examine repository age, commit history, maintainer reputation, and community engagement before trusting code. Additionally, using dependency scanning tools and software composition analysis can help identify suspicious packages before they reach production systems.
Security teams should treat this incident as a reminder to monitor for signs of compromise within their development environments and institute stronger vetting procedures for third-party code dependencies.
Berlin's government is intensively reviewing 5.79TB of state data released by ransomware group Rhysida after refusing to pay a ransom demand. The leaked files reportedly contain sensitive information on national defense and threat response plans.
Cybercriminals are exploiting thousands of compromised small-business websites to distribute ClickFix malware payloads stored in smart contracts on the BNB Smart Chain, amplifying the reach of a known threat.
Quad9 provides an open DNS recursive service that prioritizes user privacy and security at no cost. The service blocks malware and phishing domains while maintaining minimal data collection.
A government website running Ruby on Rails was exploited within hours of a critical vulnerability patch becoming public. The rapid attack demonstrates how quickly threat actors weaponize disclosed security flaws.