FakeGit campaign pushes malware through 7,600 GitHub repositories
A massive malware distribution operation abused GitHub's trusted platform to deliver 14 million downloads of credential-stealing software.
Scale of the operation
Security researchers identified a campaign dubbed 'FakeGit' that created 7,600 malicious repositories on GitHub. These repositories accumulated more than 14 million downloads before detection.
The operation distributed two types of malware: SmartLoader and StealC. Both tools are designed to compromise user credentials and system information.
Attack methodology
The attackers created repositories that mimicked legitimate open-source projects. By exploiting GitHub's reputation as a trusted platform for developers, the campaign achieved significant distribution without immediate detection.
This technique represents a growing trend of supply chain attacks targeting developer communities. Open-source repositories remain a critical vector for malware distribution due to the trust developers place in code hosting platforms.
Implications for developers
The incident underscores the need for verification processes when downloading dependencies from public repositories. Developers should verify repository authenticity, check project history, and review code before integrating external components.
GitHub has been notified and is expected to remove the malicious repositories. Organizations should audit their development environments for signs of compromise if developers downloaded packages during the campaign's active period.