Do Son 
At a glance
| Malware family | MaaS infostealer delivered via SmartLoader (NodeJS strain among final payloads) |
| Threat actor | Operators behind TroyDen’s “lure factory” (suspected, not confirmed) |
| Target or victims | Developers and AI users in North America, Asia, and Southern Europe |
| Delivery vector | Cloned GitHub repositories impersonating popular AI tools |
| Key capabilities | Screenshot capture, geolocation recon, blockchain C2 resolution, payload delivery |
| Source | Netskope Threat Labs |
TL;DR
Netskope Threat Labs found a fake AI tools malware campaign that hits developers through trojanized GitHub repositories. The attackers clone popular AI projects and hide a loader inside. Both loader stages pull their command server address from the Polygon blockchain at runtime.
How the GitHub infostealer campaign works
In April 2026, Netskope Threat Labs first reported a Malware-as-a-Service infostealer spread through the “ClickFix” trick. Since then, the operators changed tactics. Now they clone well-known GitHub repositories and redirect download links to their own payloads.
The lures imitate trusted names. They include Claude, ComfyUI, AI coding assistants, Python security guides, and Rust frameworks. As a result, developers and AI users become the main targets of this GitHub infostealer campaign.
Why developers get targeted
Developer accounts carry high privileges. They hold source code, cloud credentials, API keys, and CI/CD access. Therefore a single compromise can open the door to a software supply chain attack.
Delivery: trojanized AI repositories
The attackers clone a real repository and add a payload to a harmless-looking subdirectory. Sometimes they only edit the install instructions to point at a malicious URL. Because the root page looks authentic and lists the original contributor, victims trust it.
Netskope describes the deception plainly. “Because the root page appears authentic and the original contributor is listed, victims are lured into trusting the GitHub page.” That trust leads them to download and run the fake AI tools malware.
Infection chain: two SmartLoader stages
The first payload arrives as a zip with four files. It contains two binaries, a batch script, and a text file named gc.txt. The text file holds the real Lua code, obfuscated with a commercial tool called Prometheus.
Splitting the code this way helps it evade detection. As Netskope notes, “the individual components fail to trigger alerts” when scanned alone. The threat only appears once every file runs together in the same folder.
This first stage is SmartLoader. It profiles the victim, captures a screenshot, and beacons out. Then it downloads a second Lua script, likely obfuscated with MoonSec. The second stage repeats the same flow and fetches the final infostealer.
Command-and-control and data exfiltration
Neither loader hardcodes its command server. Instead, both query the Polygon blockchain to resolve the address at runtime. Netskope calls this a “dead drop resolver,” since updating one contract value redirects every implant.
This method is known as EtherHiding. Consequently, the operators can rotate command servers without touching the malware code. That makes simple IP blocklisting far less effective.
Before beaconing, SmartLoader runs geolocation recon and grabs a screenshot through the Windows GDI API. It then sends an encrypted JSON beacon plus the image to the command server. The reply carries configuration and a task queue for the next steps.
Attribution: confirmed versus suspected
The link to the earlier MaaS infostealer is confirmed by Netskope’s own tracking. However, the tie to the TroyDen “lure factory” is described as related activity, not proven authorship. So treat the actor identity as suspected for now.
Defense and detection guidance
First, verify any AI tool or repository before you download it. Check the account age and commit history, since two payload accounts were created only days before use. Both were reported for takedown.
Next, watch for suspicious child processes. A renamed LuaJIT interpreter reading a text file is a strong warning sign. Also monitor outbound calls to public blockchain RPC endpoints from developer machines.
Finally, protect developer credentials with hardware keys and least-privilege access.
The bottom line
This fake AI tools malware campaign shows a clear shift toward developer supply chains. The attackers pair trusted branding with blockchain-based command servers. As a result, they gain both credibility and resilience. Developers should slow down and verify before running anything from an unfamiliar repository.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
