A new malware campaign is turning interest in artificial intelligence tools into a route for enterprise intrusion. Attackers are cloning trusted GitHub projects, then hiding malicious files inside downloads that appear useful to developers and AI users.

The operation targets people looking for AI resources, coding assistants, Python security guides, Rust frameworks, Claude-related tools, and ComfyUI projects.

Financial services, banking, and technology organizations in North America, Asia, and Southern Europe have been among the most affected sectors.

Netskope said in a report shared with Cyber Security News (CSN) that the activity is linked to the broader TroyDens lure factory.

The researchers found attackers using cloned repositories to deliver a Malware-as-a-Service information stealer through a two-stage SmartLoader chain.

The campaign matters because developers often hold access to cloud environments, source code, API keys, code-signing certificates, and CI/CD systems.

Malicious and legitmate repo (Source - Netskope) — Malicious and legitmate repo (Source – Netskope)

A stolen developer session or credential can give an attacker a practical foothold inside an organization, creating a path toward data theft or software supply chain attacks.

Fake AI Tool Campaign

The attackers make their GitHub pages look convincing by copying legitimate code, documentation, contributor details, and installation instructions.

Malicious payloads are placed in harmless-looking folders or linked through altered setup steps, a tactic also seen in fake GitHub repository operations that rely on user trust.

Victims receive a ZIP archive containing lua51.dll, compiler.exe, Application.bat, and a text file named gc.txt.

The batch file launches the renamed LuaJIT interpreter, which reads and runs the hidden Lua code from the text file instead of from a conventional executable.

This layout helps the malware avoid simple security checks because each file appears less suspicious when inspected alone.

The real activity appears only when the archive’s components are present together, allowing the loader to make network requests, write files, and start new processes.

Execution chain (Source - Netskope) — Execution chain (Source – Netskope)

The first-stage Lua script is protected with Prometheus obfuscation, while the second stage appears to use MoonSec V3.

This layered approach resembles earlier SmartLoader GitHub malware delivery campaigns, where trusted code-sharing services were used to distribute multi-stage payloads.

Blockchain Hides the Control Server

SmartLoader first collects the victim’s public IP address, location details, time zone, internet provider, and a screenshot.

It then sends an encrypted beacon to a command-and-control server, giving the operator enough information to decide how to handle the compromised device.

Instead of embedding a fixed control-server address, both loader stages query a Polygon smart contract at runtime.

This EtherHiding method lets attackers replace their server address by changing a blockchain value, without rebuilding or redistributing the malware.

The second stage downloads additional Lua content and a final information-stealing payload from attacker-controlled GitHub accounts.

Researchers observed several stealer variants, including a NodeJS-based strain, showing that the framework can deliver different malware depending on the operator’s needs.

Organizations should verify project ownership, contributor history, and official release sources before running GitHub-hosted installers.

Security teams should also investigate unusual blockchain RPC traffic from script interpreters, batch files, or user-writable folders, as GitHub and GitLab malware abuse increasingly blends trusted hosting with malicious delivery.

Application controls can reduce exposure by limiting unsigned interpreters and script launchers outside approved directories.

Monitoring scheduled-task creation, raw GitHub downloads, bare-IP web requests, and unexpected screenshot capture can also help defenders spot the loader before it reaches enterprise credentials or sensitive development assets.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
URL	`http://ip-api.com/json`	Geolocation service queried by SmartLoader.
Blockchain smart contract	`0x1823A9a0Ec8e0C25dD957D0841e3D41a4474bAdc`	Polygon contract used to resolve the command-and-control address.
Method selector	`0x3bc5de30`	Smart-contract method selector used in the `eth_call` request.
Domain	`polygon.drpc.org`	Polygon RPC provider contacted by the loader.
Domain	`polygon.publicnode.com`	Polygon RPC provider contacted by the loader.
Domain	`rpc-mainnet.matic.quiknode.pro`	Polygon RPC provider contacted by the loader.
Domain	`polygon-mainnet.gateway.tatum.io`	Additional second-stage Polygon RPC fallback.
Domain	`polygon-public.nodies.app`	Additional second-stage Polygon RPC fallback.
GitHub account	`yawalinte`	Account observed hosting second-stage payload content.
GitHub account	`JuliusMAAR`	Account observed hosting identical payload content.
URL	`https://github.com/yawalinte/80/raw/refs/heads/main/ae.log`	First-stage task download location shown in the analyzed configuration.
URL	`https://github.com/JuliusMAAR/gpt-re/raw/refs/heads/main/re0.log`	Final-payload download location shown in the second-stage configuration.
URL	`https://github.com/JuliusMAAR/gpt-re/raw/refs/heads/main/re1.log`	Second-stage Lua script download location.
File name	`Application.bat`	Batch script that launches the first-stage loader.
File name	`lua51.dll`	LuaJIT runtime included in the malicious archive.
File name	`compiler.exe`	Renamed LuaJIT interpreter used by the first stage.
File name	`gc.txt`	Prometheus-obfuscated malicious Lua script.
File name	`dist.lua`	Second-stage Lua script downloaded by SmartLoader.
File name	`7d7752.exe`	LuaJIT interpreter used to execute the second stage.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Building Resilience Against Phishing & Malware and Analyze it in a safe environment – Power your SOC with ANY.RUN

The post Fake AI Tool Campaign Turns Developer Interest Into Enterprise Initial Access appeared first on Cyber Security News.