hexastrike.comPublished
Cloned, Loaded, and Stolen: How 109 Fake GitHub Repositories Delivered SmartLoader and StealC
By Maurice Fielenbach
Excerpt
We identified 109 malicious GitHub repositories across 103 accounts that impersonate legitimate projects and redirect users to embedded ZIP files containing a LuaJIT-based SmartLoader stage.
The campaign appears to be operated by a single threat actor or tightly controlled cluster based on infrastructure overlap, synchronized repository updates, and consistent tooling.
The staged malware is…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by hexastrike.com on hexastrike.com.
Mentioned in the excerpt
More from hexastrike.com2
- Trust the Tunnel, Get the Trojan: Silver Fox Delivers Atlas RAT via Weaponized VPN Installershexastrike.com · Published 25 Mar
- FLEXRAT – ChilloutVR Lures, Shared Secrets, and an OPSEC Hangoverhexastrike.com · Published 4 Oct
On the same topics
- StealC Is Back, and This Time It's a RATVaronis · Published 22 Oct
- Threat Group Cards: A Threat Actor EncyclopediaETDA Threat Group Cards · Added 25 Oct
- Warden Stealer: The Rapid Rise of an Infostealer with an Appetite for AI Agent DataGen Digital · Published 8 Oct
- Unmasking a Multi-Stage Loader: AutoIt Abuse Leading to Vidar Stealer Command-and-Control CommunicationLevelBlue · Published 7 May
