Cybercriminals are cloning popular GitHub repositories for AI tools and developer resources to distribute an infostealer, according to Netskope Threat Labs.
(Source: Netskope)
Netskope came across the campaign while tracking a Windows-based MaaS infostealer, first reported in April 2026, that was spread through the ClickFix social engineering trick.
Continuing to follow the operation, the researchers found that the group behind it had shifted its delivery method, now pushing payloads through impersonated GitHub repositories hosting popular AI resources. Netskope tracks these repositories under the name TroysDen’s.
“To deceive developers, attackers clone well-known repositories and subtly integrate malicious payloads. They usually add the payload to a benign-looking subdirectory or modify the URLs on the installation instructions. Because the root page appears authentic and the original contributor is listed, victims are lured into trusting the GitHub page, leading them to download and execute the MaaS malware infostealer,” Netskope explained.
Among the “lures” found were fake tools branded as Claude, ComfyUI, AI coding assistants, Python security guides, and Rust frameworks.
A hidden interpreter, not a compiler
The malicious payload arrives in a ZIP archive containing four files: two binaries (lua51.dll and compiler.exe), a batch script (Application.bat), and a text file (gc.txt).
Lua51.dll is a legitimate LuaJIT runtime. One of its functions allows Lua code to call Windows APIs directly by name at runtime, so those calls do not appear in the import table of the executable running the code.
Despite its name, compiler.exe is a renamed LuaJIT interpreter. The batch script launches compiler.exe with gc.txt as an argument, causing the interpreter to read and execute the contents of the text file. At that point, the Prometheus virtual machine reconstructs the malicious code from an encrypted string pool.
From there, all malicious activity, including network requests, file writes, and process creation, runs inside compiler.exe.
Together, the four files make up SmartLoader, a malware loader Netskope has previously seen distributed through GitHub repositories.
Netskope said placing the code in a plain text file rather than a standalone executable gives it a “defense-evasion advantage,” since automated scanners and sandboxes tend to check files one at a time and none of the pieces alone sets off an alert.
Command-and-control hidden on a blockchain
SmartLoader starts by sending a GET request to ip-api.com to collect the victim’s IP address, country, city, time zone, and internet provider, information that may help the attackers decide which victims are worth pursuing.
Rather than hardcoding a server address, it resolves its command-and-control IP from the Polygon blockchain at runtime, a technique known as EtherHiding, querying a smart contract through public RPC providers to get the address to contact.
Before reporting in, SmartLoader takes a screenshot of the victim’s desktop, which gets sent together with an encrypted beacon containing the loader’s ID, a device identifier, the victim’s public IP, and the operating system version.
This setup lets the attackers move infrastructure without touching the malware itself. If a server gets blocked, they update the value stored in the smart contract, and every infected machine picks up the new address on its own.
The response carries encrypted configuration data and a task list, which in this case instructed SmartLoader to download the second stage that ultimately delivers the infostealer.
A second stage with its own disguise
The second-stage script, dist.lua, is downloaded along with its own bundled LuaJIT interpreter and DLL. Static analysis linked its obfuscation to MoonSec, a different tool than the one used in stage one, though no version marker was found in the code.
“Upon execution, the second stage Lua script is highly similar to the first loader,” researchers added.
It reuses the same XOR key to encrypt outbound traffic and decrypt server responses, runs the same geo-location check, and hides its command-and-control address with EtherHiding, adding two more RPC providers as fallbacks beyond the ones used in stage one.
Netskope found the second-stage files hosted on two GitHub accounts, created five days apart in July 2026, both serving identical payloads. Both accounts have since been reported for takedown.
Netskope’s analysis across multiple samples turned up a mix of infostealers, including the NodeJS-based strain the company first reported in April.
The campaign has targeted organizations in North America, Asia, and Southern Europe, with financial services, banking, and technology among the most affected sectors.
