Netskope discloses trojanized GitHub repositories pushing AI-themed SmartLoader infostealers at developers

What Netskope disclosed

On 2026-08-04, Netskope Threat Labs publicly disclosed a campaign that delivers a Windows infostealer to AI developers by cloning popular GitHub repositories and seeding them into search results for AI tooling. org describe the operation as the latest iteration of an ongoing Malware-as-a-Service activity previously observed spreading the same NodeJS-based infostealer through the ClickFix social-engineering technique in April 2026. Instead of relying on luring victims into pasting commands, the operators now distribute their first-stage loader through impersonated GitHub projects that look routine at a glance but carry altered installation URLs or extra payloads inside otherwise plausible subdirectories.

The cloned pages still list original contributors, which gives the repositories an air of authenticity when a developer discovers them during a routine search. Lures seen in the operation impersonate Claude, ComfyUI, AI coding assistants, Python security guides, and Rust frameworks, all categories that attract developers experimenting with AI build pipelines and language-tooling. Because developers typically have access to source repositories, cloud environments, API keys, code-signing certificates and CI/CD systems, the disclosure treats every infected workstation as a potential pivot into an organization's software supply chain rather than a simple endpoint compromise.

How the SmartLoader chain works

txt. txt as input, causing the LuaJIT interpreter to execute the heavily obfuscated Lua payload hidden inside the text file through Netskope's Prometheus virtual machine. The use of a renamed interpreter plus a plain text payload is described as a defense-evasion advantage, since each component on its own tends to look inert and individual automated scanners rarely reconstruct the chain.

com to fingerprint the victim by IP address, country, city, time zone, and internet provider, takes a desktop screenshot, and assembles a beacon containing the loader ID, a device identifier, the public IP, and the operating system version. The operators then assign the infected host a task list and a second stage. The threat report labels this design a loader the company's analysts have previously seen distributed through GitHub repositories, and it stops short of crediting any specific threat actor.

Command-and-control on the Polygon blockchain

The report's most unusual technical finding is the command-and-control channel. Rather than hardcoding a server address, both SmartLoader stages resolve their current C2 IP from the Polygon blockchain using a technique the report calls EtherHiding. The loader makes an eth_call request to a fixed smart contract through public Polygon RPC providers and retrieves whatever server address the operators have written into on-chain state, which can be updated at any time without touching the malware itself.

If a server is blocked or seized, the operators edit the smart contract value and every infected machine picks up the new destination on its next beacon, giving the infrastructure a durability that traditional C2 rotations cannot match. lua together with its own bundled LuaJIT interpreter and runtime DLL, repeats the same geolocation precheck, encrypts outgoing traffic and server responses with the same XOR key used in stage one, and reuses EtherHiding while adding two extra Polygon RPC providers as fallbacks. org notes the second-stage obfuscator matches MoonSec V3, a different tool than the first stage, though no version marker was recovered from the code.

Both operator accounts hosting the second stage, named yawalinte and JuliusMAAR and created five days apart in July 2026, have since been reported for takedown.

Who has been affected and what the impact looks like

Netskope's telemetry, as summarized in the publisher reports, places victims primarily in North America, Asia, and Southern Europe, with financial services, banking, and technology among the most affected sectors. That profile aligns with the lure set: the impersonated Claude, ComfyUI, and AI coding-assistant repositories tend to attract developers inside organizations that are already building AI features, often with privileged access to model APIs, cloud accounts, and CI/CD pipelines. The infostealer variants observed at the end of the chain include the NodeJS-based MaaS strain first documented in April 2026, with the capability to lift browser credentials and cloud API keys directly from the developer's workstation.

From a reader-impact standpoint, the disclosure reframes the incident from a single developer losing personal cookies into a potential supply-chain event: a stolen GitHub or cloud credential on an engineer's laptop can be reused against internal repositories, package registries, or production infrastructure. The two source articles treat the campaign as active research rather than a fully contained incident, so organizations should assume exposure remains a live concern until the impersonated repositories and the Polygon smart contract are independently disrupted.

Defensive steps and what to watch next

Both reports converge on a short defensive checklist. org write-up. Least-privilege cloud credentials and immediate rotation of any API keys that may have been present on developer workstations are recommended, since the infostealer variants target exactly that material.

Open questions remain. The two publishers do not name a threat actor, do not publish the infected repositories, and only describe one Polygon smart contract indirectly through the EtherHiding flow, so it is unclear how many loader variants currently resolve there or whether the campaign has added non-Polygon fallbacks. lua plus MoonSec V3 obfuscation as the highest-fidelity hunt signature until that telemetry is available.