StealC

FakeGit malware campaign reactivates, distributing SmartLoader via 17,610 malicious GitHub repositories

Security researchers report the reactivation of the FakeGit campaign in October 2026, identifying more than 17,610 malicious repositories on GitHub distributing SmartLoader malware. The campaign, which had previously pushed the StealC infostealer, now appears to be using SmartLoader as the primary payload. The malicious repositories impersonate legitimate software projects to lure developers and users into downloading compromised code.