Fake AI Tools on GitHub Used for Enterprise Initial Access
A new campaign is weaponizing developer interest in AI tools, using compromised GitHub repositories to deliver malware and gain initial access to enterprise networks.
A sophisticated malware campaign is exploiting the burgeoning interest in artificial intelligence by luring developers with fake AI tools hosted on GitHub. Attackers are meticulously cloning legitimate repositories, injecting malicious payloads into downloads that appear to offer valuable AI resources, coding assistance, or framework tools. This tactic specifically targets individuals seeking AI-related utilities, coding assistants, Python security guides, Rust frameworks, Claude-related tools, and ComfyUI projects.
The campaign's impact is significant, with financial services, banking, and technology organizations across North America, Asia, and Southern Europe identified as primary targets. Researchers from Netskope have linked this activity to the broader TroyDens lure factory, noting the use of a two-stage SmartLoader chain to deliver a Malware-as-a-Service information stealer. The danger lies in the fact that developers often possess privileged access to critical enterprise assets, including cloud environments, source code repositories, API keys, code-signing certificates, and CI/CD systems. A compromised developer account can provide attackers with a direct pathway into an organization, facilitating data theft or supply chain attacks.
To maintain credibility, the attackers are adept at mimicking trusted GitHub projects. They replicate code, documentation, contributor details, and installation instructions, making their malicious repositories appear legitimate. Malware is hidden within seemingly innocuous folders or introduced through altered setup procedures, a common tactic in operations that rely on user trust. Victims typically receive a ZIP archive containing files such as lua51.dll, compiler.exe, Application.bat, and a text file named gc.txt.
The execution chain involves a renamed LuaJIT interpreter launched by the batch file. This interpreter is configured to read and execute malicious Lua code from the gc.txt file, rather than a conventional executable. This layered approach, where individual files appear less suspicious, helps the malware evade basic security detection. The full malicious activity only manifests when all components of the archive are present, enabling the loader to initiate network communications, write files, and spawn new processes.
Further complicating detection, the initial Lua script is protected using Prometheus obfuscation, while the second stage employs MoonSec V3 obfuscation. This multi-layered defense mechanism is reminiscent of previous SmartLoader campaigns that leveraged code-sharing platforms for distributing complex, multi-stage payloads. The use of these obfuscation techniques makes static analysis of the malware significantly more challenging for security researchers.
A particularly innovative aspect of this campaign is its use of blockchain technology for command and control (C2). Instead of embedding a fixed C2 server address within the malware, both stages of the SmartLoader query a Polygon smart contract at runtime. This technique, referred to as EtherHiding, allows attackers to dynamically update their C2 server address by altering a value on the blockchain, eliminating the need to rebuild or redistribute the malware. This makes tracking and disrupting the C2 infrastructure considerably more difficult.
Upon successful execution, the SmartLoader gathers sensitive victim information, including public IP address, location, time zone, internet provider, and a screenshot of the user's desktop. This data is then encrypted and sent in a beacon to the C2 server. The second stage is capable of downloading additional Lua scripts and a final information-stealing payload from attacker-controlled GitHub accounts. Researchers have observed various stealer variants, including one written in NodeJS, indicating the flexibility of the framework to deliver different types of malware tailored to the attackers' objectives.
To mitigate this threat, organizations are advised to rigorously verify the authenticity of GitHub projects, scrutinize contributor histories, and always obtain software from official, trusted sources. Security teams should monitor for unusual blockchain RPC traffic originating from script interpreters or unexpected network requests. Implementing application controls to restrict the execution of unsigned interpreters and script launchers, along with monitoring for suspicious activities like scheduled task creation or raw GitHub downloads, can help detect and prevent this type of attack before sensitive development assets are compromised.