109 Fake GitHub Repositories Used to Deliver SmartLoader and StealC Malware

Hexastrike uncovered a large-scale campaign in which an attacker cloned legitimate GitHub projects across 109 repositories to host malicious ZIPs that install a LuaJIT-based loader (SmartLoader) and an in-memory infostealer (StealC); SmartLoader hides execution, performs anti-debug checks, resolves C2 via a Polygon blockchain dead-drop, exfiltrates data to bare-IP servers, and establishes dual scheduled-task persistence while staging additional payloads from attacker-controlled GitHub repositories.