Fake AI Tool Repos on GitHub Spread Infostealers to Developers

The Setup: Familiar Repos, Hidden Payloads

The attackers — tracked by Netskope under the name TroysDen’s — are targeting developers specifically because developers clone first and ask questions later. The lures include fake versions of Claude, ComfyUI, AI coding assistants, Python security guides, and Rust frameworks.

The malicious payload arrives as a ZIP file containing four files:

• lua51.dll — a legitimate LuaJIT runtime
• compiler.exe — a renamed LuaJIT interpreter (not a compiler, despite the name)
• Application.bat — a batch script that kicks everything off
• gc.txt — a plain text file that holds the actual malicious Lua code

The batch script runs the interpreter against the text file. The Prometheus virtual machine inside reconstructs the malicious code from an encrypted string pool. All the bad activity — network requests, file writes, process creation — runs inside compiler.exe.

This four-file bundle is SmartLoader, a loader Netskope has seen before. Related GitHub-focused threats have also appeared in Miasma Worm Hits Microsoft GitHub, Targets AI Dev Tools.

Why It Evades Detection

Splitting the payload across four unremarkable files is the point. Automated scanners and sandboxes typically check files individually. None of the four pieces triggers an alert on its own. Together, they’re a working infostealer delivery system.

Hiding the code in a plain .txt file rather than an executable gives it what Netskope calls a “defense-evasion advantage.” It’s a low-tech trick that works precisely because the tooling isn’t looking for it.

The Blockchain Twist

SmartLoader doesn’t hardcode a command-and-control server address. Instead, it resolves the address at runtime from the Polygon blockchain — a technique known as EtherHiding — by querying a smart contract through public RPC providers.

Before checking in, it takes a screenshot of the victim’s desktop and sends an encrypted beacon with the loader ID, device identifier, public IP, and OS version. It also hits ip-api.com first to collect geolocation data, likely to help the attackers filter for high-value targets.

The blockchain approach means if a server gets blocked, the attackers simply update the smart contract value. Every infected machine picks up the new address automatically, with no changes to the malware itself. Similar evolving tactics appear in This Week’s Cyber Threats: AI Evasion, JS Backdoors.

A Second Stage With Its Own Obfuscation

The server responds with a task list instructing SmartLoader to download a second-stage script, dist.lua, which comes bundled with its own LuaJIT interpreter and DLL.

The second stage uses different obfuscation tooling (linked to MoonSec) but mirrors the first stage closely — same XOR key for traffic encryption, same geolocation check, same EtherHiding technique with additional RPC fallbacks.

Netskope found the second-stage files hosted across two GitHub accounts created five days apart in July 2026, both serving identical payloads. Both have since been reported for takedown.

The final payload is a mix of infostealers, including a NodeJS-based strain Netskope first flagged in April 2026.

Who’s Being Targeted

The campaign has hit organizations in North America, Asia, and Southern Europe. Financial services, banking, and technology are the most affected sectors — which tracks, given that developers in those industries are exactly the kind of people cloning AI tool repos.

The Practical Takeaway

The attack works because it exploits developer habits, not developer ignorance. Cloning a repo that looks legitimate, from a contributor you recognize, in a category you trust, is normal behavior.

A few things worth doing now:

• Verify repo provenance carefully — check the account creation date, star history, and commit activity before cloning anything AI-related
• Treat ZIP archives from repos with extra suspicion, especially ones containing .dll, .exe, and .bat files together
• Don’t assume a familiar name means a safe repo — Claude, ComfyUI, and similar names are exactly what attackers are betting you’ll trust

The AI tooling ecosystem moves fast, and that speed is being used against the people building with it. For another developer-targeted example, see Fake AI Guides Hide AsyncRAT in Multi‑Stage Malware.