How 7,600 GitHub Repos Are Spreading SmartLoader Malware Right Now

Robert Moore · 2026-07-20

Cybersecurity researchers have uncovered a massive campaign involving nearly 7,600 malicious GitHub repositories. Over 800 of these pretend to be AI tools or Model Context Protocol (MCP) servers, but they're actually delivering a nasty piece of malware called SmartLoader. The operation, dubbed FakeGit, is still active and growing. ### The FakeGit Playbook So how does this work? Attackers are getting clever with their deception. They copy legitimate projects, create developer profiles that look totally real, write READMEs that sound convincing, and then package everything with a malicious ZIP file. It's a social engineering game, and they're playing it well. Here's what makes FakeGit so dangerous: - **Copied projects**: They clone real repos and inject malware - **Lookalike profiles**: Fake accounts that mirror real developers - **Convincing READMEs**: Documentation that seems trustworthy - **Malicious ZIPs**: The payload hidden inside ### Why You Should Care If you're a developer or use GitHub for work, this hits close to home. The scammers are targeting people who trust open-source code. They know developers often grab repos without double-checking the source. SmartLoader can do serious damage once it's on your machine. > "Always verify the publisher before downloading any repository code." ### How to Protect Yourself Staying safe isn't complicated, but it takes a little effort. Here are some tips: - Check the account age and activity before downloading - Look for verified badges on developer profiles - Scan all downloaded ZIP files with antivirus software - Use sandbox environments to test unfamiliar code ### The Bigger Picture This campaign shows how cybercriminals are evolving. They're using platforms we trust to spread malware. The AI angle makes it even trickier because everyone's excited about new AI tools right now. But don't let that excitement cloud your judgment. Always double-check where your code comes from. A few extra seconds of verification could save you from a major headache. The FakeGit campaign is a reminder that in the world of cybersecurity, trust is earned, not given.