Malware

Stealc

Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline. Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.

Indicators of Compromise 3

GitHub Repo FakeGit GitHub Repo SmartLoader GitHub Repo https://github.com/FakeGit

MITRE ATT&CK TTPs 10

T1059.001
PowerShell
Execution
 T1059.005
Visual Basic
Execution
 T1071.001
Web Protocols
Command And Control
 T1090
Proxy
Command And Control
 T1105
Ingress Tool Transfer
Command And Control
 T1106
Native API
Execution
 T1136
Create Account
Persistence
 T1170
T1170
 T1195.001
Compromise Software Dependencies and Development Tools
Initial Access
 T1204.002
Malicious File
Execution

Source Articles

FakeGit malware campaign returns with 17,610 malicious GitHub repos
The FakeGit malware campaign has reemerged, leveraging 17,610 malicious GitHub repositories to distribute the SmartLoader malware, which in turn delivers the StealC infostealer. The attack uses throwaway and compromised developer accounts to host repositories with deceptive README files that include download links to malicious ZIP archives. The campaign rapidly redeployed, creating over 13,000 repositories in 34 hours, with 97% of commits modifying only the README to point to SmartLoader payloads. Attackers maintain persistence by using forks, release assets, and issue attachments to host backup copies of malware, evading takedown efforts.
bleeping-computer ·2w ago
FakeGit campaign uses 7,600 GitHub repos to push SmartLoader malware
The FakeGit campaign leverages over 7,600 malicious GitHub repositories to distribute SmartLoader and StealC malware, primarily through a technique called 'agentbaiting' that targets AI agents and developers. These repositories mimic legitimate AI tools and services, often appearing in public AI registries, and deliver malware via malicious ZIP files disguised as installers. SmartLoader establishes persistence, retrieves C2 addresses via a Polygon smart contract, and downloads further stages from GitHub to deploy the StealC information stealer.
bleeping-computer ·3mo ago
FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware
The FakeGit campaign leverages nearly 7,600 malicious GitHub repositories to distribute SmartLoader malware, often disguised as AI skills or Model Context Protocol (MCP) servers. These repositories use convincing READMEs and copied projects to trick both human users and AI agents into downloading malicious ZIP files. The attack chain involves a LuaJIT loader that drops SmartLoader, which then deploys StealC, an information stealer. A novel technique called AgentBaiting enables AI agents to autonomously discover and act on malicious repositories without human intervention, increasing the risk of supply chain compromise.
hacker-news ·3mo ago