Hackers use AI to create fake GitHub repositories to distribute Lumma Stealer malware.

This new cyber threat targets developers looking for game mods, hacked apps, and cryptocurrency mining tools: cybercriminals use AI to create a fake GitHub repository containing professionally crafted README files that mislead users. As part of this campaign, tracked as Water Kurita, the attackers are distributing SmartLoader, a malicious downloader that launches Lumma Stealer.

Key points of the attack

• The repository contains only README files that mimic a legitimate project.
• The SmartLoader loader is hidden in a malicious ZIP archive.
• SmartLoader uses cloaking techniques to bypass antivirus protection.
• The main goal is to steal logins, passwords, crypto wallets and browser data.

How the attack is carried out: The GitHub repository contains artificial intelligence-generated deceptive README files with an attractive description and structured content using emoticons and logos. Victims looking for a useful tool download the archive and run the file that initiates the attack:

1. Launcher.bat launches the Lua loader;

2. The Lua script connects to the C2 server and receives commands;

3. SmartLoader Lumma Stealer and other malicious modules are loaded;

4. Stolen data (logins, cryptocurrency wallets, cookies) are sent to the attacker’s C2 server.

Cybersecurity experts advise: do not download files from unfamiliar GitHub repositories. Use an antivirus that analyzes the behavior of programs. Block the execution of Lua scripts on the system. Restrict access to GitHub APIs for unknown applications. Validate code before importing into a project.

Criminals are increasingly using artificial intelligence to disguise their attacks. Fake GitHub repositories are becoming a new tool for spreading malware. Users should be careful when downloading third-party resources, and companies should implement a zero-trust policy to protect their infrastructure*