The key point: The FakeGit campaign distributes the malware SmartLoader and StealC across 7,600 GitHub repositories, achieving more than 14 million downloads and demonstrating the exploitation of trusted developer platforms as attack vectors.
A large-scale campaign called FakeGit is distributing the malware SmartLoader and StealC through more than 7,600 manipulated GitHub repositories, which have together accumulated more than 14 million downloads. For CISOs, this distribution strategy via a trusted developer ecosystem represents a significant entry point into enterprise-wide infrastructure.
The FakeGit campaign leverages GitHub’s credibility: the attackers have created or compromised more than 7,600 repositories through which SmartLoader and StealC malware reach developers and systems. With over 14 million installations, the campaign has achieved significant reach. The malware variants serve different purposes: SmartLoader functions as a loader for additional malware payloads, while StealC is primarily designed for stealing credentials and sensitive data.
For Chief Information Security Officers, this attack model presents a particular challenge. GitHub is often treated as a trusted source in enterprise environments, such as when obtaining open-source libraries or retrieving developer tools. Through forged or compromised repositories, attackers can inject malware directly into build and deployment pipelines without traditional perimeter security taking effect. The large number of 7,600 repositories indicates a coordinated and industrialized distribution network.
CISOs should review their controls over external code sources: repository verification, code scanning prior to import, and access restrictions on public repositories are necessary. Simultaneously, regular inspection of installed dependencies and their provenance is required to identify already-injected malware.
Source: www.bleepingcomputer.com · Published July 22, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.7.3.