FakeGit campaign uses 7,600 GitHub repos to push SmartLoader malware

A large-scale operation dubbed ‘FakeGit’ is pushing SmartLoader and StealC malware through 7,600 malicious GitHub repositories that accumulated more than 14 million downloads.

Grace Ops

CONTENT OPTIMIZATION · AEO/GEO

PENDING

Not yet scored. Next refresh: 02:00 UTC.

discussion

0 comments

Sign in to join the thread and vote on comments.

Loading comments…

audit trail / provenance1

Provenance

Claims tie surfaced fields back to sources, models, or heuristics.

severity.upliftheuristicn/a
Ransomware campaign indicators detected — floor raised to at least high.

What changed

Append-only revisions when ingest or analysts evolve the record.

No revision rows stored yet.

Sources

https://www.bleepingcomputer.com/news/security/fakegit-campaign-uses-7-600-github-repos-to-push-smartloader-malware/

Curated Jul 21, 2026 by Aidan Duffy, Threat intelligence editor, AHackaday./Methodology/Sources verified.

Brief grounded in 1 source.

Grace Ask GracereadyGrace is ready

Grounded in this brief only — FakeGit campaign uses 7,600 GitHub repos to push SmartLoader malware. Press ⌘K any time.

You're answering aschange anytime

Pick a playor type your own ↓

Tone

Pull keywords → Generate

Generate an answer and Grace will return a grounded response for this incident.

social pulse

mentions (24h)pending scan

velocitytrend flat

mentions delta—

platform splitLive social scan not run yet — open the feed after the next /api/social/refresh.

keywords

monitoring

x analyticsheat 0

authors 0verified 0%

likes0

retweets0

replies0

quotes0