Harish Kumar 
Developers chasing the latest AI coding assistant or open-source LLM tool are walking into a trap. Netskope Threat Labs has uncovered an escalating campaign in which threat actors clone popular GitHub repositories tied to AI tools, developer utilities, and frameworks to quietly distribute an info-stealing malware strain, and they’re doing it with a blockchain-powered command-and-control (C2) system that makes takedown efforts almost pointless.
The campaign dates back to April 2026, when Netskope first exposed a Malware-as-a-Service (MaaS) Node-JS info-stealer that spread via the “ClickFix” social engineering technique. Since then, the operators tracked as part of the broader “TroysDen” lure factory have pivoted delivery methods.
Instead of relying solely on fake CAPTCHA prompts, they now clone legitimate GitHub repositories for tools like Claude, ComfyUI, AI coding assistants, Python security guides, and Rust frameworks.
Fake AI Tools on GitHub Deliver Infostealer
Because the original contributor listing and root page look authentic, victims, mostly in North America, Asia, and Southern Europe, concentrated in financial services, banking, and tech sectors, are tricked into trusting and executing the payload.
What sets this campaign apart is its layered SmartLoader chain deployed not once, but twice. Stage 1 arrives as a four-file zip containing a Lua script obfuscated with Prometheus, hidden inside an innocuous text file (gc.txt) that executes only when paired with a bundled LuaJIT interpreter.
This “split-file” trick evades sandboxes that inspect files in isolation, since neither component appears malicious on its own. Once running, Stage 1 performs geolocation reconnaissance, captures a screenshot via the Windows GDI API, and beacons an XOR-encrypted payload.
It then downloads a second-stage script (dist.lua), obfuscated with MoonSec V3, which repeats the same playbook before finally deploying the actual info-stealer, often the same NodeJS-based malware Netskope flagged back in April.
The most notable technical feature is the use of EtherHiding; both loader stages resolve their C2 IP address at runtime via a read-only call to a Polygon smart contract.
This means attackers can redirect every infected machine simply by updating a value on the blockchain, without touching a single line of malware code. Stage 2 even expands the list of RPC providers used to query the contract, adding resilience against blocklisting.
Developer machines are prime targets precisely because they hold the keys to the kingdom: source code, cloud credentials, API keys, code-signing certificates, and CI/CD access. A single compromised developer laptop can cascade into a full software supply chain breach, affecting downstream users and organizations.
Netskope has identified and reported the GitHub accounts distributing these payloads for takedown, but new clones can appear just as quickly. Developers should verify repository authenticity, avoid executing bundled binaries from unfamiliar forks, and treat any AI-tool “installer” requesting unusual permissions with suspicion.
As Malware-as-a-Service operations continue to evolve their delivery and evasion techniques, vigilance at the individual developer level remains the first and often the last line of defense.
About the Author
Kiran 
