Back Broadcom

FakeGit Infrastructure Re-Armed in Large-Scale RePointing Campaign

Broadcom • October 9, 2026

According to Apiiro, security researchers observed a massive automated campaign re-arming a fleet of more than 17,000 malicious GitHub repositories linked to the FakeGit ecosystem. Skipping the need for new infrastructure, the threat actor utilizes a tactic termed RePointing, executing rapid, automated commits to update existing project README files so their download links redirect to fresh ZIP archives. These archives contain a modified LuaJIT runtime and obfuscated scripts designed to deliver the SmartLoader loader and ultimately drop the StealC infostealer. The operation relies on thousands of throwaway developer accounts alongside compromised legitimate accounts to maintain persistence, bypass static URL blocklists, and harvest user credentials and session tokens.

Symantec protects you from this threat, identified by the following:

Associated malicious indicators are blocked and detected by existing policies within Carbon Black products. The recommended policy at a minimum is to block all types of malware from executing (Known, Suspect, and PUP) as well as delay execution for cloud scan to get maximum benefit from Carbon Black Cloud reputation service.

Machine Learning-based

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

FakeGit Malware Campaign Resurfaces with 17,610 Malicious Repositories The FakeGit malware campaign has reactivated, distributing SmartLoader malware via over 17,610 fake repositories on GitHub. This resurgence, noted by researchers from Apiiro, began on October 4, 2026, and has already seen the creation of more than 13,000 repositories in just 34 hours. The malicious repositories employ convincing README files with download buttons that link to ZIP archives containing SmartLoader, which is used to further distribute malware, including the StealC infostealer. The campaign's persistence is attributed to GitHub's repository removal policies, which often overlook a significant number of malicious repositories. Attackers can easily redirect existing repositories to new malicious payloads, rendering traditional blocklisting ineffective. Users are advised to verify repository owners and obtain software from official sources to mitigate risks. If SmartLoader execution is suspected, users should treat it as a potential account compromise and revoke sessions and access tokens. 3 sources 55

Extracted Entities

FakeGit Infrastructure Re-Armed in Large-Scale RePointing Campaign

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Malware (1)

Platforms (2)