Threat Overview
Apiiro research **published October 6, 2026**, with additional independent reporting **October 8**, documents an active October 4–6 re-arming of 17,610 GitHub lure repositories. Researchers verified SmartLoader ZIP payloads behind the fleet and observed 13,000+ coordinated README edits in 34 hours, typically repointing download buttons without creating new repositories. Approximately 700 accounts appeared to belong to real developers (219 supported by third-party historical evidence), while the remainder largely resembled throwaways. The ZIP commonly contains a batch launcher (`Launcher.cmd`/`App.bat`), renamed LuaJIT interpreter (`luajit.exe`/`luau.exe`/`gcc.exe`), optional `lua51.dll`, and an obfuscated Lua program disguised as `userdata.txt`, `ico64.txt` or `tcp.log`. Apiiro describes blockchain-based C2 retrieval and a chain leading to StealC credential/session theft based on published reverse engineering. **Confirmed:** active malicious distribution and payload availability. **Not confirmed by this publication:** 17,610 infected hosts or successful compromise of every account that viewed a README. ATT&CK: T1204.002, T1036, T1059, T1105, T1555, T1539.
References
Apiiro primary research, October 6, 2026
BleepingComputer independent report, October 8, 2026
Impacted Systems
**Products/components:** Windows developer/user endpoints executing ZIPs from malicious GitHub repositories; GitHub accounts and downstream browser/SSO/cloud sessions potentially exposed after StealC execution. **Versions:** No GitHub product version is vulnerable; this is social engineering and malware delivery, not a GitHub CVE. **Platform/deployment:** Windows endpoint; GitHub is cloud-hosted distribution. **Prerequisite:** User downloads/extracts and runs malicious archive/launcher (sometimes after bypassing SmartScreen). **Exposure:** Access to fake GitHub repositories, including AI-skill/MCP-themed lures; GitHub web access alone is not evidence of execution. **Ports:** ordinary HTTPS/TCP 443 delivery; no campaign-exclusive port. **Fixed versions:** Not applicable; remove payload and remediate affected endpoints/accounts. **Unaffected:** macOS/Linux execution was not established for the Windows loader described by Apiiro; merely visiting a lure is not equivalent to infection.
Why this matters
Newly observed fleet-wide re-pointing reactivates long-lived trusted-looking repositories and defeats simplistic domain blocklists; developer access makes stolen sessions particularly impactful.
Exploitation Status
Confirmed malicious ZIP distribution, re-pointing and malware functionality per Apiiro. Active end-user compromise prevalence is unknown; account-takeover findings are researcher assessments supported by public GitHub history.
What this hunt looks for
GitHub-delivered ZIP provenance, renamed LuaJIT execution, batch launchers, obfuscated text payloads, host profiling, and follow-on identity anomalies.
Required logs
Use only queries whose listed Sentinel tables are ingested. The hunt set uses: DeviceFileEvents, DeviceNetworkEvents, DeviceProcessEvents, SecurityEvent, SigninLogs.
Hunt 1: First pass — Lua interpreter launching obfuscated text/log payload
Required telemetry: DeviceProcessEvents. High signal when interpreter is newly extracted in a download/temp path with a text payload; LuaJIT is also legitimate software.
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName in~ ("luajit.exe","luau.exe","gcc.exe") or ProcessCommandLine has_any ("lua51.dll","userdata.txt","ico64.txt","tcp.log")
| where ProcessCommandLine has_any (".txt",".log","lua51","userdata","ico64") or (FileName in~ ("luajit.exe","luau.exe") and FolderPath has_any ("Downloads","Temp","AppData"))
| project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by TimeGenerated descHunt 2: FakeGit launcher batch files and interpreter invocation
Required telemetry: DeviceProcessEvents. Command-line visibility required; do not treat arbitrary batch scripts as campaign matches.
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe")
| where ProcessCommandLine has_any ("Launcher.cmd","App.bat","luajit.exe","luau.exe","userdata.txt","ico64.txt","tcp.log")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath
| order by TimeGenerated descHunt 3: File extraction patterns consistent with SmartLoader archives
Required telemetry: DeviceFileEvents. Multi-artifact co-occurrence improves fidelity; names vary by ZIP so absence is not exclusion.
DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where FileName in~ ("Launcher.cmd","App.bat","luajit.exe","luau.exe","lua51.dll","userdata.txt","ico64.txt","tcp.log")
| summarize DistinctArtifacts=dcount(FileName), Artifacts=make_set(FileName,12), Paths=make_set(FolderPath,12), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by DeviceName, bin(TimeGenerated,1h)
| where DistinctArtifacts >= 2
| order by DistinctArtifacts descHunt 4: Downloaded GitHub ZIP provenance on endpoints
Required telemetry: DeviceFileEvents. FileOriginUrl often absent on archives downloaded by CLI tools or proxies; a GitHub ZIP is not inherently malicious.
DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where FileName endswith ".zip"
| extend Origin=tostring(column_ifexists("FileOriginUrl",""))
| where Origin has_any ("github.com/","raw.githubusercontent.com/")
| project TimeGenerated, DeviceName, FileName, FolderPath, Origin, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated descHunt 5: GitHub raw ZIP requests in endpoint network telemetry
Required telemetry: DeviceNetworkEvents. RemoteUrl may contain only a hostname, not a URL path; use proxy logs for raw paths.
DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| where RemoteUrl has_any ("github.com","raw.githubusercontent.com")
| where RemoteUrl has ".zip" or InitiatingProcessFileName in~ ("powershell.exe","curl.exe","wget.exe","luajit.exe","luau.exe")
| project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, InitiatingProcessCommandLine, ActionType
| order by TimeGenerated descHunt 6: SmartLoader-related host profiling and staged network behavior
Required telemetry: DeviceNetworkEvents. ip-api.com is widely used legitimately; require process lineage and archive context.
DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| where RemoteUrl =~ "ip-api.com" or InitiatingProcessFileName in~ ("luajit.exe","luau.exe")
| summarize Connections=count(), Destinations=make_set(RemoteUrl,20), IPs=make_set(RemoteIP,20), Ports=make_set(RemotePort,10) by DeviceName, InitiatingProcessFileName, bin(TimeGenerated,1h)
| order by Connections descHunt 7: Windows Security 4688 fallback for interpreter and launcher
Required telemetry: SecurityEvent. Requires process creation auditing with command-line capture; this is a Windows fallback.
SecurityEvent
| where TimeGenerated >= ago(30d) and EventID == 4688
| extend Cmd=tostring(column_ifexists("CommandLine","")), NewProc=tostring(column_ifexists("NewProcessName",""))
| where Cmd has_any ("luajit","luau.exe","userdata.txt","ico64.txt","Launcher.cmd","App.bat") or NewProc has_any ("luajit.exe","luau.exe")
| project TimeGenerated, Computer, Account, NewProc, Cmd, ParentProcessName=tostring(column_ifexists("ParentProcessName",""))
| order by TimeGenerated descHunt 8: Follow-on cloud sign-in anomalies after suspected credential theft
Required telemetry: SigninLogs. Generic post-compromise enrichment only; cannot attribute account activity to FakeGit without endpoint linkage.
SigninLogs
| where TimeGenerated >= ago(7d)
| where ResultType == "0"
| summarize IPs=dcount(IPAddress), Countries=dcount(Location), Locations=make_set(Location,8), Apps=make_set(AppDisplayName,8) by UserPrincipalName, bin(TimeGenerated,1d)
| where IPs >= 5 and Countries >= 2
| order by IPs descDetection Notes
- Highest signal: Lua interpreter launched from Downloads/Temp with a large text/log argument, plus related launcher and file artifacts on the same device.
- GitHub and ip-api.com are legitimate services; do not classify domain access alone as malicious. URL paths may be absent from MDE RemoteUrl.
- Artifact names vary by repository; a strict filename-only hunt misses renamed loaders and newer generations.
- DeviceFileEvents FileOriginUrl is optional and may not be populated for command-line or browser downloads.
- StealC session theft cannot be inferred from a new Entra sign-in alone; correlate endpoint execution with identity events.
- Absent endpoint file/process telemetry prevents proving archive execution.
All conclusions are limited to data sources and retention actually available in Microsoft Sentinel. Absence of matching activity cannot establish absence of compromise on unmonitored assets or in non-ingested logs. No customer-specific Sentinel workspace was queried and no customer-specific finding is asserted.
