🔍 FakeGit reactivates at scale on GitHub

FakeGit has resumed activity with 17,610 malicious GitHub repositories distributing SmartLoader, with over 13,000 repos pushed in 34 hours and a peak of 2,999 per hour. Researchers found 97% of sampled commits only modified README files, and 88% redirected download buttons to ZIP archives installing SmartLoader. At least 700 accounts appear tied to legitimate developers. FakeGit has been active in similar form since January.

The campaign’s persistence comes from reuse, not rebuild: existing repos are simply re-pointed to fresh payload locations, while copies remain in forks, release assets, issue attachments, and separate hosting repos. This makes file-by-file takedowns and URL-based blocking structurally weak.

🛰️ Open sources - closed narratives
@sitreports