Cybercriminals clone GitHub repositories to distribute infostealer

Netskope Threat Labs researchers have discovered a campaign that exploits cloned GitHub repositories to spread a Windows-based infostealer called MaaS. The technique, dubbed TroysDen's, impersonates popular repositories of AI tools and developer resources, tricking users with seemingly legitimate pages.

Quick Response

  • Attackers clone popular GitHub repositories and integrate malicious payloads in subdirectories or installation instructions
  • The SmartLoader malware uses evasion techniques such as executing code from text files and C2 addresses hidden on the blockchain
  • The campaign has primarily targeted financial and technology sectors in North America, Asia, and Southern Europe

The technical analysis of the SmartLoader malware

The malicious payload arrives in a ZIP archive containing four files: two binaries (lua51.dll and compiler.exe), a batch script (Application.bat), and a text file (gc.txt). Lua51.dll is a legitimate LuaJIT runtime that allows Lua code to be executed to directly call Windows APIs, hiding these calls from the executable's import table.

Contrary to expectations, compiler.exe is not a compiler but a renamed LuaJIT interpreter. The batch script launches compiler.exe with gc.txt as an argument, causing the text file's content to be executed. The Prometheus virtual engine then reconstructs the malicious code from an encrypted string.

All malicious activity, including network requests, file writing, and process creation, is performed within compiler.exe. This architecture provides a defense evasion advantage, as automated scanners and sandboxes do not detect malicious behavior by analyzing files individually.

Hidden communication on blockchain

SmartLoader begins by sending a GET request to ip-api.com to gather user location information, including IP address, country, city, time zone, and Internet service provider. This data helps attackers determine which victims to pursue.

Instead of encoding a server address, SmartLoader resolves the command and control IP from the Polygon blockchain in real-time, using a technique known as EtherHiding. It queries a smart contract via public RPC providers to obtain the address to contact.

Before reporting in, SmartLoader captures a screenshot of the victim's desktop, which is sent along with an encrypted beacon containing the loader ID, device identifier, victim's public IP address, and operating system version.

This setup allows attackers to move the infrastructure without modifying the malware itself. If a server is blocked, they update the value stored in the smart contract, and every infected machine automatically collects the new address.

The second stage of the malware

The server's response carries encrypted configuration data and a list of tasks that instruct SmartLoader to download the second stage, which ultimately delivers the infostealer. The second stage script, dist.lua, is downloaded along with its own embedded LuaJIT interpreter and DLL.

Static analysis linked the obfuscation of dist.lua to MoonSec, a different tool from the one used in the first stage, although no version marking was found in the code.

Upon execution, the Lua script of the second stage is highly similar to the first loader. It reuses the same XOR key to encrypt outgoing traffic and decrypt server responses, performs the same geolocation check, and hides its command and control address with EtherHiding, adding two additional RPC providers as fallback solutions compared to those used in the first stage.

The campaign's infrastructure

Netskope discovered that the second stage files were hosted on two GitHub accounts, created five days apart in July 2026, both serving identical payloads. Both accounts were reported for removal.

Netskope's analysis of multiple samples revealed a mix of infostealers, including the NodeJS-based variant that the company first reported in April. The campaign targeted organizations in the financial services, banking, and technology sectors in North America, Asia, and Southern Europe.

The campaign's impact on strategic sectors

The TroysDen's campaign has particularly affected high-sensitivity sectors such as financial services, banking, and technology. These sectors are particularly vulnerable because they often use advanced development tools and AI resources that are among the main targets of attackers. Financial organizations, in particular, handle large amounts of sensitive data, making them prized targets for infostealers that can steal credentials, customer information, and transactional data.

Netskope's analysis revealed that victims are geographically concentrated in North America, Asia, and Southern Europe. This distribution suggests a strategy aimed at targeting areas with advanced economies and developed digital infrastructures, where the value of stolen data is potentially higher. The attackers' ability to adapt their techniques to different geographical contexts demonstrates a sophisticated understanding of market dynamics and local security practices.

The security implications of evasion techniques

The use of SmartLoader represents a significant evolution in malware delivery techniques. The choice to execute code from a text file instead of a binary provides a defense evasion advantage, as automated scanners and sandboxes do not detect malicious behavior by analyzing files individually.

This technique demonstrates how attackers are adopting emerging technologies to enhance the operational capabilities of their malware, making traditional detection and mitigation tactics increasingly ineffective.

The challenges for proactive defense

The TroysDen's campaign highlights several challenges for organizations seeking to protect themselves from these advanced threats:

  • Behavior-based detection: The evasion techniques used by SmartLoader require security solutions to adopt behavior-based approaches rather than static file analysis. This necessitates investments in machine learning technologies and executive context analysis.
  • Blockchain monitoring: The ability of attackers to hide critical information on decentralized infrastructures like blockchains obliges organizations to monitor these environments for suspicious activity, a complex task that requires specialized skills.
  • Developer education: As attackers target GitHub repositories, it is crucial to educate developers on best security practices, including verifying the origins of downloaded codes and using static and dynamic analysis tools.

In an ever-evolving threat landscape, the ability to quickly adapt to new attack techniques will be crucial to maintaining an adequate level of defense.

The future prospects of cyber threats

The TroysDen's campaign represents only the beginning of a broader trend towards the use of advanced technologies in cybercrime operations. As malware developers adopt increasingly sophisticated techniques, organizations will need to invest in cutting-edge security solutions and develop a proactive response capability.

Among future areas of concern is the widespread adoption of decentralization techniques for command and control, which could make it even more difficult to track and block malicious infrastructures. Additionally, the integration of artificial intelligence tools into the malware lifecycle could lead to autonomous systems capable of dynamically adapting to the security environments of victims.

In this context, collaboration between security researchers, technology solution providers, and developer communities will be essential to develop effective defenses against emerging threats.

Editorial Note and Disclaimer

The guides and content published on GoYou are the result of independent research and analysis activities, for informational, educational, and in-depth purposes.

GoYou does not constitute a journalistic publication or an editorial product pursuant to Law No. 62/2001 and does not perform real-time information activities.

The GoYou project does not provide professional, technical, legal, or financial advice and disclaims any liability for the misuse of the information published.

In the Crypto sector, every investment involves risks: readers are invited to always inform themselves autonomously before making any decision.