An October 6, 2026 report from Apiiro describes a new wave of the FakeGit campaign. Researchers counted 17,610 GitHub repositories containing archives associated with SmartLoader. More than 13,000 repositories were pushed again over 34 hours on October 4 and 5. The operation relies on trust in familiar projects and ordinary-looking download instructions.
Copied projects become lures
The repositories often reuse the name or appearance of legitimate software projects. Their README files provide installation steps and a download button leading to a ZIP archive inside the repository or a linked resource. That presentation can make a malicious executable look like a normal project component.
The archive installs SmartLoader, a loader designed to retrieve or run other components. Apiiro links the campaign to StealC, an infostealer that can steal browser-saved passwords and session cookies. An active cookie may grant access to a service without another login screen, so a compromise can affect work accounts even if their password was not entered again.
October’s wave mostly changed links
Apiiro found that 97% of the commits in its sample changed only the README. Across the commits examined, 88% redirected the “Download” button to a SmartLoader archive verified by the researchers. The repositories were already there: the operator changed the link destination instead of creating new projects.
The report also describes accounts that appear to belong to real developers. Apiiro confirmed suspicious activity on 219 established accounts using earlier GitHub history the operator could not backdate; the company estimates that about 700 accounts may belong to real developers. This evidence does not establish how each account was compromised.
A single takedown is not enough
An entry on a blocklist does not necessarily remove a file hosted on GitHub. Apiiro found copies in forks, older archives, attachments, and separate repositories. When the main link is blocked, an operator can point the README to another copy.
The report also says that checks covering one GitHub URL format can miss another path to the same content. This complicates automated detection. The study’s figures describe Apiiro’s observed inventory and sampling; they are not an exhaustive measure of every download or victim.
Reduce risk before running a repository
Before running software downloaded from GitHub, confirm that the repository owner matches the expected publisher and that the installation link appears on its official site. A polished README, copied commit history, or familiar name does not prove authenticity. Apply the same checks to extensions, AI skills, and MCP servers listed in public catalogs.
Development teams should limit write permissions for tokens and service accounts, require review before running external scripts, and monitor unexpected changes to installation files. If an employee ran a suspicious archive, the team should review potentially exposed sessions and tokens as well as repositories the account could access.
How Soclyde relates
Soclyde does not detect FakeGit or protect a workstation where SmartLoader has run. Its local-first encrypted vault helps people and small teams manage access without placing the password vault in a centralized cloud service operated by Soclyde. If an infostealer could read secrets on a device, however, treat them as exposed and rotate them from a clean environment.
What to remember
FakeGit persists by keeping credible repositories and changing where their download buttons lead. Check the provenance of a project and every archive before running it; after a suspicious launch, revoke potentially exposed sessions and secrets. Our infostealer guide explains what to do after an infection.
