FakeGit Campaign: Exploiting GitHub and Model Context Protocol MCP to Deploy SmartLoader
The "FakeGit" campaign is a large-scale supply chain and social engineering operation leveraging approximately 7,600 malicious GitHub repositories and 6,600 unique accounts to distribute the SmartLoader malware. By masquerading as legitimate AI skills and Model Context Protocol (MCP) servers, the attackers manipulate AI agents to recommend malicious repositories to developers. The technical payload utilizes Cloud Server-Side Request Forgery (SSRF) to deploy SmartLoader, which subsequently installs the StealC information stealer. This operation specifically targets users integrating AI-driven workflows for platforms like Gmail and WhatsApp, aiming for high-value credential and sensitive data theft through the exploitation of the emerging AI agent ecosystem and the perceived trust of the GitHub platform.
Microsoft Threat Intelligence: Evolution of Crypto Clipper and CryptoBandits Malware
Microsoft Threat Intelligence, in coordination with Europol, has identified a significant escalation in cryptocurrency-targeted malware operations involving Crypto Clipper and CryptoBandits. Moving beyond rudimentary clipboard manipulation, these threats now utilize Tor-based Command and Control (C2) infrastructure, worm-like propagation via malicious USB .lnk files, and Remote Code Execution (RCE) capabilities. The ecosystem is deeply integrated into a "cybercrime assembly line," where infostealers like StealC and Amadey facilitate initial access for broader ransomware deployments. This sophisticated multi-stage approach targets digital wallet seed phrases and executes automated transaction interception, posing a systemic risk to both individual assets and enterprise infrastructure.