FakeGit activity reportedly resumes across 17,610 malicious GitHub repositories
SecurityUnverifiedUpdated:
Researchers report that FakeGit used 17,610 GitHub repositories after resuming activity. Convincing README download buttons reportedly direct users to malicious archives containing SmartLoader.
README download buttons lead to SmartLoader
According to Apiiro researchers, FakeGit uses convincing README instructions whose download buttons point to ZIP archives containing SmartLoader. The researchers also identified at least 700 accounts that appeared to belong to legitimate developers, while saying the operation mostly uses throwaway accounts.
In July, researchers at Island reported 7,600 fake GitHub repositories associated with FakeGit and distributing SmartLoader.
Apiiro researchers say FakeGit resumed activity on October 4 and is now using 17,610 GitHub repositories. They say more than 13,000 repositories were pushed in 34 hours, with a peak of 2,999 per hour.
The reported activity relies on existing repositories and changes their download links, according to the researchers. They say malicious archives can remain available through forks, older files, release assets, issue attachments, and separate download-hosting repositories.
Sources
- BleepingComputerFakeGit malware campaign returns with 17,610 malicious GitHub reposRead source →