Security researchers report the reactivation of the FakeGit campaign in October 2026, identifying more than 17,610 malicious repositories on GitHub distributing SmartLoader malware. The campaign, which had previously pushed the StealC infostealer, now appears to be using SmartLoader as the primary payload. The malicious repositories impersonate legitimate software projects to lure developers and users into downloading compromised code.

What should defenders do?

Users and developers are advised to exercise caution when downloading repositories on GitHub. Verifying repository legitimacy, checking contributor histories, and relying on official software sources are recommended. GitHub's automated and manual takedown processes are actively removing identified malicious repositories. No software patch is required, as the vulnerability lies in the legitimacy of the repositories rather than a code flaw.

highMalware

FakeGit malware campaign reactivates, distributing SmartLoader via 17,610 malicious GitHub repositories

Threat actors return with updated infrastructure targeting developers and software users

Cyber.TechVoidPublished about 3 hours agoUpdated less than a minute ago1 min read

FakeGit malware campaign reactivates, distributing SmartLoader via 17,610 malicious GitHub repositories

Key Takeaways

The FakeGit campaign has reactivated in October 2026, distributing SmartLoader malware through over 17,610 malicious GitHub repositories.
The repositories impersonate legitimate software projects to deceive developers and users.
SmartLoader is understood to function as a malware loader, potentially delivering additional payloads such as infostealers.
The exact victim count and specific targeted industries have not been specified in the reporting.

Related Security News

highCyber Attacks

Unpatched AhsayCBS Vulnerabilities Exploited in the Wild to Deploy Webshells and Cryptominers

Threat actors are exploiting two unpatched vulnerabilities in the AhsayCBS backup management platform. One vulnerability is rated critical severity and another medium severity. The exploitation has been observed in the wild and is being used to deploy webshells for persistent access and cryptocurrency miners for monetization. No patches are currently available, and the vulnerabilities remain unpatched. Affected organizations using AhsayCBS for backup management are at risk of persistent compromise and resource misuse.

BleepingComputer25 minutes ago1 min read