type: entity · created: 2026-07-21 · updated: 2026-07-21 · tags: [loader, stealer] · confidence: medium · affected_sectors: [technology] · au_impact: false
🎯 IOCs · Stealc +1
Indicators of compromise · Stealc +1 — 8 shown
ayelife57[.]resthxxp://144[.]31[.]151[.]8/hxxp://31[.]56[.]19[.]29/hxxp://62[.]60[.]226[.]232/hxxp://213[.]176[.]73[.]162/api/hxxp://185[.]10[.]68[.]110/api/7d70e6d7d4fa8d888bd46680aa604dd9f56285dc78c429ac8ab8e4d88266651f3a2f83a62307345bbf273a4292f190636e09110162c7f12a51cb98018c17f27a
Defanged third-party indicators (abuse.ch). The defanging is deliberate: never click, resolve or fetch these values. An indicator corroborates a report — it never proves one, and its presence here does not mean this story's hosts are listed.
SmartLoader — Malware Loader
SmartLoader is a malware loader distributed through the Fakegit Campaign — nearly 7,600 malicious GitHub repositories discovered by Island researchers. It establishes persistence on infected systems and delivers StealC info-stealer as a secondary payload.
Capabilities
- Initial access: Distributed via fake/piggybacked GitHub repositories
- Persistence: Establishes persistence mechanisms on infected hosts
- Secondary payload: Delivers stealc info-stealer (credential theft, data exfiltration)
Distribution: FakeGit Campaign
SmartLoader was the primary payload of the Fakegit Campaign: - ~7,600 malicious GitHub repositories - Over 800 posing as AI skills or MCP servers - Uses copied projects, lookalike developer profiles, and convincing READMEs
Related Pages
- Fakegit Campaign — The campaign distributing SmartLoader
- stealc — Secondary payload delivered after initial load