A recent malware campaign is exploiting the growing interest in artificial intelligence tools to infiltrate enterprise systems. Attackers are duplicating reputable GitHub repositories, embedding malicious files within downloads that appear beneficial to developers and AI enthusiasts.
This operation specifically targets individuals seeking AI resources, coding assistants, Python security guides, Rust frameworks, and tools related to Claude and ComfyUI. Sectors such as financial services, banking, and technology organizations across North America, Asia, and Southern Europe have been notably impacted.
Researchers have linked this activity to the broader TroyDens lure factory. The attackers employ cloned repositories to deliver a Malware-as-a-Service information stealer through a two-stage SmartLoader chain.
The significance of this campaign lies in the fact that developers often possess access to critical assets like cloud environments, source code, API keys, code-signing certificates, and CI/CD systems. Compromising a developer’s session or credentials can provide attackers with a foothold within an organization, potentially leading to data theft or software supply chain attacks.
Deceptive Tactics and Execution
To enhance credibility, attackers meticulously replicate legitimate code, documentation, contributor details, and installation instructions on their GitHub pages. Malicious payloads are discreetly placed in innocuous-looking folders or linked through altered setup steps, a tactic reminiscent of previous fake GitHub repository operations that exploit user trust.
Victims receive a ZIP archive containing files such as lua51.dll, compiler.exe, Application.bat, and a text file named gc.txt. The batch file initiates the renamed LuaJIT interpreter, which reads and executes concealed Lua code from the text file, rather than from a conventional executable.
This method allows the malware to evade basic security checks, as each file appears benign when inspected individually. The malicious activity becomes apparent only when the archive’s components are present together, enabling the loader to make network requests, write files, and initiate new processes.
The first-stage Lua script is obfuscated using Prometheus, while the second stage employs MoonSec V3. This layered approach mirrors earlier SmartLoader GitHub malware delivery campaigns, where trusted code-sharing services were utilized to distribute multi-stage payloads.
Utilizing Blockchain for Command and Control
SmartLoader initially gathers the victim’s public IP address, location details, time zone, internet provider, and a screenshot. It then sends an encrypted beacon to a command-and-control server, providing the operator with sufficient information to decide on the next steps for the compromised device.
Instead of embedding a fixed control-server address, both loader stages query a Polygon smart contract at runtime. This EtherHiding method allows attackers to change their server address by modifying a blockchain value, without the need to rebuild or redistribute the malware.
The second stage downloads additional Lua content and a final information-stealing payload from attacker-controlled GitHub accounts. Researchers have observed several stealer variants, including a NodeJS-based strain, indicating that the framework can deliver different malware depending on the operator’s objectives.
Organizations are advised to verify project ownership, contributor history, and official release sources before executing GitHub-hosted installers. Security teams should also monitor for unusual blockchain RPC traffic from script interpreters, batch files, or user-writable folders, as GitHub and GitLab malware abuse increasingly combines trusted hosting with malicious delivery.
Implementing application controls can reduce exposure by limiting unsigned interpreters and script launchers outside approved directories. Monitoring scheduled-task creation, raw GitHub downloads, bare-IP web requests, and unexpected screenshot captures can also assist defenders in detecting the loader before it accesses enterprise credentials or sensitive development assets.
This campaign underscores the evolving tactics of cybercriminals who exploit the trust placed in open-source platforms and the growing interest in AI tools. As attackers become more sophisticated, it is imperative for organizations to enhance their security measures, conduct thorough verifications, and remain vigilant against such deceptive practices.
