AI Developers Targeted by Trojanized GitHub Repositories Distributing Infostealer

Cybercriminals are increasingly targeting artificial intelligence developers by cloning popular GitHub repositories that host AI tools and developer resources. These malicious actors then distribute an infostealer through these trojanized versions, according to a recent analysis by Netskope Threat Labs. This campaign, tracked under the name TroysDen's, represents a shift from previous distribution methods that relied on social engineering tactics.

The attackers deceive developers by creating exact replicas of well-known GitHub repositories. They subtly embed malicious payloads within these cloned repositories, often by adding them to benign-looking subdirectories or altering URLs within installation instructions. The deceptive nature of these repositories, which display authentic-looking root pages and original contributor information, lures unsuspecting developers into downloading and executing the malware, which in this case is a Malware-as-a-Service (MaaS) infostealer.

Among the lures observed were fake tools branded as Claude, ComfyUI, AI coding assistants, Python security guides, and Rust frameworks. The malicious payload is delivered within a ZIP archive containing four files: two binaries (lua51.dll and compiler.exe), a batch script (Application.bat), and a text file (gc.txt). The lua51.dll is a legitimate LuaJIT runtime, while compiler.exe is a renamed LuaJIT interpreter. The batch script executes the interpreter with the text file as an argument, causing it to read and execute the malicious code within.

This code, reconstructed from an encrypted string pool by the Prometheus virtual machine, enables all malicious activities, including network requests, file writes, and process creation, to run undetected within the disguised interpreter. This technique, where malicious code resides in a plain text file rather than a standalone executable, provides a defense-evasion advantage, as automated scanners and sandboxes typically analyze files individually and are less likely to flag any single component.

The SmartLoader malware begins its operation by collecting victim information, such as IP address, country, city, time zone, and internet provider, by sending a GET request to ip-api.com. This data helps attackers prioritize targets. Instead of hardcoding a command-and-control (C2) server address, the malware dynamically resolves it from the Polygon blockchain at runtime using a technique known as EtherHiding. It queries a smart contract through public RPC providers to obtain the C2 address.

Before establishing communication, SmartLoader captures a screenshot of the victim's desktop. This screenshot, along with an encrypted beacon containing the loader's ID, device identifier, victim's public IP, and operating system version, is sent to the C2 server. This method allows attackers to change their infrastructure without modifying the malware itself; if a server is blocked, they simply update the smart contract value, and all infected machines automatically retrieve the new address.

The C2 response includes encrypted configuration data and a task list, which typically instructs SmartLoader to download a second-stage payload. This second stage, a Lua script named dist.lua, is downloaded with its own bundled LuaJIT interpreter and DLL. While its obfuscation is linked to the MoonSec tool, no version marker was found. This stage reuses the same XOR key for encryption, performs the same geo-location check, and hides its C2 address using EtherHiding, adding more RPC providers as fallbacks.

Netskope identified the second-stage files hosted on two GitHub accounts, both serving identical payloads. These accounts have since been reported for takedown. The campaign has impacted organizations across North America, Asia, and Southern Europe, with the financial services, banking, and technology sectors being among the most affected. The mix of infostealers observed includes the NodeJS-based strain previously reported by Netskope.