Act
active
FakeGit campaign resurfaces with 17,610 malicious GitHub repos spreading StealC
- Engineer — Act: Active campaign seeding fake GitHub repos with SmartLoader that delivers the StealC credential stealer — developers cloning unvetted repos are the attack vector. Audit recently cloned GitHub repos and CI/CD dependency pulls since early October for unexpected or newly-created repos, and verify repo authenticity before use.
- SOC/IR — Act: StealC infostealer is being deployed on developer endpoints via trojanized repos; hunt for StealC behavioral indicators (credential store access, C2 beaconing) in EDR across developer workstations, and review git clone activity logs since the campaign reactivated this month.
- Leader — Plan: Large-scale fake-repo campaign targeting developers creates credential theft risk that could cascade to production access. This quarter, assess whether developer policies require repo vetting before cloning and consider enforcing allowlists or signing requirements in CI/CD pipelines.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.