A new malware campaign is turning interest in artificial intelligence tools into a route for enterprise intrusion. Attackers are cloning trusted GitHub projects, then hiding malicious files inside downloads that appear useful to developers and AI users.
The operation targets people looking for AI resources, coding assistants, Python security guides, Rust frameworks, Claude-related tools, and ComfyUI projects.
Financial services, banking, and technology organizations in North America, Asia, and Southern Europe have been among the most affected sectors.
Netskope said in a report shared with Cyber Security News (CSN) that the activity is linked to the broader TroyDens lure factory.
The researchers found attackers using cloned repositories to deliver a Malware-as-a-Service information stealer through a two-stage SmartLoader chain.
The campaign matters because developers often hold access to cloud environments, source code, API keys, code-signing certificates, and CI/CD systems.
A stolen developer session or credential can give an attacker a practical foothold inside an organization, creating a path toward data theft or software supply chain attacks.
The attackers make their GitHub pages look convincing by copying legitimate code, documentation, contributor details, and installation instructions.
Malicious payloads are placed in harmless-looking folders or linked through altered setup steps, a tactic also seen in fake GitHub repository operations that rely on user trust.
Victims receive a ZIP archive containing lua51.dll, compiler.exe, Application.bat, and a text file named gc.txt.
The batch file launches the renamed LuaJIT interpreter, which reads and runs the hidden Lua code from the text file instead of from a conventional executable.
This layout helps the malware avoid simple security checks because each file appears less suspicious when inspected alone.
The real activity appears only when the archive’s components are present together, allowing the loader to make network requests, write files, and start new processes.
The first-stage Lua script is protected with Prometheus obfuscation, while the second stage appears to use MoonSec V3.
This layered approach resembles earlier SmartLoader GitHub malware delivery campaigns, where trusted code-sharing services were used to distribute multi-stage payloads.
SmartLoader first collects the victim’s public IP address, location details, time zone, internet provider, and a screenshot.
It then sends an encrypted beacon to a command-and-control server, giving the operator enough information to decide how to handle the compromised device.
Instead of embedding a fixed control-server address, both loader stages query a Polygon smart contract at runtime.
This EtherHiding method lets attackers replace their server address by changing a blockchain value, without rebuilding or redistributing the malware.
The second stage downloads additional Lua content and a final information-stealing payload from attacker-controlled GitHub accounts.
Researchers observed several stealer variants, including a NodeJS-based strain, showing that the framework can deliver different malware depending on the operator’s needs.
Organizations should verify project ownership, contributor history, and official release sources before running GitHub-hosted installers.
Security teams should also investigate unusual blockchain RPC traffic from script interpreters, batch files, or user-writable folders, as GitHub and GitLab malware abuse increasingly blends trusted hosting with malicious delivery.
Application controls can reduce exposure by limiting unsigned interpreters and script launchers outside approved directories.
Monitoring scheduled-task creation, raw GitHub downloads, bare-IP web requests, and unexpected screenshot capture can also help defenders spot the loader before it reaches enterprise credentials or sensitive development assets.
Indicators of Compromise (IoCs):-
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Building Resilience Against Phishing & Malware and Analyze it in a safe environment – Power your SOC with ANY.RUN
Hackers are actively probing AI systems, turning exposed gateways and agent tools into routes for…
Hackers are making some phishing pages harder to track by changing the code delivered to…
A cyber incident reportedly forced a British power plant to halt operations for about four…
Russian hackers have used a new backdoor called HOOKEDGE to target defense manufacturers, government bodies,…
TITAN ransomware is pairing file encryption with an ambitious claim: artificial intelligence that can sort…
A fake student resume is being used to place a remote-access tool on researchers’ Windows…