FakeGit malware campaign returns with 17,610 malicious GitHub repos

The FakeGit malware campaign has returned with over 17,610 malicious repositories on GitHub designed to distribute the SmartLoader malware. The campaign reactivated earlier in October 2026 and is being used to push the StealC infostealer to unsuspecting users. SmartLoader acts as a delivery mechanism, loading additional malicious payloads onto compromised systems. The scale of the campaign is significant, with tens of thousands of fake repositories mimicking legitimate projects. StealC is a well-known information-stealing malware capable of harvesting credentials, browser data, and other sensitive information. The use of GitHub as a distribution platform lends a false sense of legitimacy to the malicious repositories. Users and developers are advised to exercise caution when cloning or using repositories from unknown sources. The campaign highlights the ongoing abuse of trusted developer platforms for malware distribution.