Malware
FakeGit Malware Campaign Resurfaces with 17,610 Malicious GitHub Repositories
The FakeGit operation has reactivated, pushing SmartLoader and StealC infostealer via 17,610 GitHub repos in 34 hours. Legitimate developers’ accounts are being hijacked, and the malware spreads through deceptive README links. Defenders should audit GitHub repos, block SmartLoader downloads, and monitor for StealC activity.
What Happened
On October 4, the FakeGit campaign resumed, creating 17,610 new repositories on GitHub in just 34 hours. The repos host a ZIP payload that installs SmartLoader, a loader that distributes the StealC infostealer.
Impact
At least 700 accounts that appear to belong to legitimate developers are used to host the malicious repos, increasing the risk of supply‑chain compromise. The deceptive README files lure users into downloading the payload, which then spreads other malware.
Defender Actions
- Audit GitHub repositories for unfamiliar or newly created repos that contain download links to ZIP archives.
- Block or quarantine SmartLoader binaries and monitor for its execution on endpoints.
- Inspect accounts for unauthorized repo creation and enforce stricter access controls.
- Deploy endpoint detection that flags StealC infostealer signatures.
Related articles
RemControl Android Banking Malware Targets European and Canadian Users via Fake IPTV Ads
RemControl, a new Android malware‑as‑a‑service platform, has been delivering banking trojans through fake TVTap IPTV ad sites. The campaign, active since May, targets users in Italy, France, Spain, Poland, Portugal, Canada and the Middle East. Defenders should block known malicious domains, enforce app‑store vetting, and monitor for phishing overlays on Android devices.
Read briefing
Hirudo Android Malware Hijacks Banking Apps to Steal Credentials
Hirudo is an Android malware that replaces legitimate banking apps with malicious copies, disabling security checks to harvest credentials and remotely control devices. It targets banks in Indonesia, China, India, Mexico, Morocco, and Thailand, and is delivered via apps that masquerade as shopping or entertainment services. Defenders should verify app signatures, enforce Play Integrity, restrict Accessibility permissions, and deploy mobile security solutions to detect hooking engines.
Read briefing
BTMOB Android RAT: Phishing, Fake App Stores, and Accessibility Exploit
BTMOB is an Android RAT that spreads via phishing sites and counterfeit app stores, then abuses Accessibility Services to gain full device control. The malware is sold with an APK‑builder, enabling rapid, code‑free payloads. Defenders should block malicious domains, disable unknown accessibility services, and enforce app‑store vetting.
Read briefing
DYNOWIPER Wiper Attack on Poland’s Energy Infrastructure: What SecOps Need to Know
A coordinated destructive campaign on 29 Dec 2025 deployed the DYNOWIPER wiper against Poland’s renewable energy farms and a major CHP plant, wiping data from Windows systems. Defenders must patch exposed Fortinet devices, enforce MFA, and deploy canary file monitoring to detect and stop the malware.
Read briefing