GoKawiilFakeGit campaign reactivates with 17,610 fake GitHub repos spreading SmartLoader
Apiiro researchers report that the FakeGit campaign resumed activity on October 4, pushing over 13,000 malicious repositories in 34 hours and reaching a total of 17,610 fake GitHub repos. The repos use README files with download buttons linking to ZIP archives containing SmartLoader malware, which is then used to deliver other payloads like StealC. At least 700 of the accounts involved reportedly belong to legitimate developers, though most are throwaway accounts.