Fake AI Tool Campaign Turns Developer Interest Into Enterprise Initial Access

A new malware campaign is turning interest in artificial intelligence tools into a route for enterprise intrusion. Attackers are cloning trusted GitHub projects, then hiding malicious files inside downloads that appear useful to developers and AI users.

The operation targets people looking for AI resources, coding assistants, Python security guides, Rust frameworks, Claude-related tools, and ComfyUI projects.

Financial services, banking, and technology organizations in North America, Asia, and Southern Europe have been among the most affected sectors.

Netskope said in a report shared with Cyber Security News (CSN) that the activity is linked to the broader TroyDens lure factory.

The researchers found attackers using cloned repositories to deliver a Malware-as-a-Service information stealer through a two-stage SmartLoader chain.

The campaign matters because developers often hold access to cloud environments, source code, API keys, code-signing certificates, and CI/CD systems.

A stolen developer session or credential can give an attacker a practical foothold inside an organization, creating a path toward data theft or software supply chain attacks.

The attackers make their GitHub pages look convincing by copying legitimate code, documentation, contributor details, and installation instructions.

Malicious payloads are placed in harmless-looking folders or linked through altered setup steps, a tactic also seen in fake GitHub repository operations that rely on user trust.

Victims receive a ZIP archive containing lua51.dll, compiler.exe, Application.bat, and a text file named gc.txt.

The batch file launches the renamed LuaJIT interpreter, which reads and runs the hidden Lua code from the text file instead of from a conventional executable.

This layout helps the malware avoid simple security checks because each file appears less suspicious when inspected alone.

The real activity appears only when the archive’s components are present together, allowing the loader to make network requests, write files, and start new processes.

The first-stage Lua script is protected with Prometheus obfuscation, while the second stage appears to use MoonSec V3.

This layered approach resembles earlier SmartLoader GitHub malware delivery campaigns, where trusted code-sharing services were used to distribute multi-stage payloads.

SmartLoader first collects the victim’s public IP address, location details, time zone, internet provider, and a screenshot.

It then sends an encrypted beacon to a command-and-control server, giving the operator enough information to decide how to handle the compromised device.

Instead of embedding a fixed control-server address, both loader stages query a Polygon smart contract at runtime.

This EtherHiding method lets attackers replace their server address by changing a blockchain value, without rebuilding or redistributing the malware.

The second stage downloads additional Lua content and a final information-stealing payload from attacker-controlled GitHub accounts.

Researchers observed several stealer variants, including a NodeJS-based strain, showing that the framework can deliver different malware depending on the operator’s needs.

Organizations should verify project ownership, contributor history, and official release sources before running GitHub-hosted installers.

Security teams should also investigate unusual blockchain RPC traffic from script interpreters, batch files, or user-writable folders, as GitHub and GitLab malware abuse increasingly blends trusted hosting with malicious delivery.

Application controls can reduce exposure by limiting unsigned interpreters and script launchers outside approved directories.

Monitoring scheduled-task creation, raw GitHub downloads, bare-IP web requests, and unexpected screenshot capture can also help defenders spot the loader before it reaches enterprise credentials or sensitive development assets.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
URL	http://ip-api.com/json	Geolocation service queried by SmartLoader.
Blockchain smart contract	0x1823A9a0Ec8e0C25dD957D0841e3D41a4474bAdc	Polygon contract used to resolve the command-and-control address.
Method selector	0x3bc5de30	Smart-contract method selector used in the eth_call request.
Domain	polygon.drpc.org	Polygon RPC provider contacted by the loader.
Domain	polygon.publicnode.com	Polygon RPC provider contacted by the loader.
Domain	rpc-mainnet.matic.quiknode.pro	Polygon RPC provider contacted by the loader.
Domain	polygon-mainnet.gateway.tatum.io	Additional second-stage Polygon RPC fallback.
Domain	polygon-public.nodies.app	Additional second-stage Polygon RPC fallback.
GitHub account	yawalinte	Account observed hosting second-stage payload content.
GitHub account	JuliusMAAR	Account observed hosting identical payload content.
URL	https://github.com/yawalinte/80/raw/refs/heads/main/ae.log	First-stage task download location shown in the analyzed configuration.
URL	https://github.com/JuliusMAAR/gpt-re/raw/refs/heads/main/re0.log	Final-payload download location shown in the second-stage configuration.
URL	https://github.com/JuliusMAAR/gpt-re/raw/refs/heads/main/re1.log	Second-stage Lua script download location.
File name	Application.bat	Batch script that launches the first-stage loader.
File name	lua51.dll	LuaJIT runtime included in the malicious archive.
File name	compiler.exe	Renamed LuaJIT interpreter used by the first stage.
File name	gc.txt	Prometheus-obfuscated malicious Lua script.
File name	dist.lua	Second-stage Lua script downloaded by SmartLoader.
File name	7d7752.exe	LuaJIT interpreter used to execute the second stage.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Building Resilience Against Phishing & Malware and Analyze it in a safe environment – Power your SOC with ANY.RUN