Cybercriminals are increasingly targeting AI developers by cloning trusted GitHub repositories and hiding malware inside fake developer tools.
Netskope Threat Labs has linked the activity to an ongoing Malware-as-a-Service (MaaS) operation that previously used ClickFix social-engineering lures to distribute a Node. js-based infostealer.
The latest campaign targets users searching for AI resources, coding assistants, Python security guides, Rust frameworks, Claude-related tools, and ComfyUI projects.
Attackers copy legitimate repositories, preserve authentic-looking project pages, and alter installation links or add malicious files inside harmless-looking folders.
This tactic is especially dangerous because developers often have access to source code, cloud environments, API keys, code-signing certificates, CI/CD systems, and enterprise services.
A stolen developer credential could allow attackers to move beyond one device and potentially compromise an organization’s software supply chain.
Victims have primarily been observed across North America, Asia, and Southern Europe. Financial services, banking, and technology organizations were among the most affected sectors.
Malicious AI Tools Exposed
The malicious download is usually delivered as a ZIP archive containing four files: lua51.dll, compiler.exe, Application.bat, and gc.txt. While the archive may look harmless, each component is needed to activate the infection chain.
The lua51.dll file is a legitimate LuaJIT runtime, while compiler.exe is a renamed LuaJIT interpreter.
The batch file launches the interpreter and instructs it to execute gc.txt, which appears to be an ordinary text file. In reality, the text file contains heavily obfuscated malicious Lua code.
A key feature of this campaign is its use of EtherHiding. This technique stores or retrieves command-and-control information through blockchain smart contracts.
Rather than embedding a fixed C2 domain or IP address in the malware, both SmartLoader stages query the same Polygon smart contract during execution.
The first-stage loader uses public Polygon RPC providers to make an eth_call request and retrieve the current C2 server address. This gives operators a flexible way to redirect infected systems.
By updating a value in the smart contract, they can change the destination server without rebuilding or redistributing the malware.
The first stage downloads a second Lua payload, known as dist. lua,lua, along with another LuaJIT interpreter and runtime files.
Researchers identified GitHub accounts, including yawalinte and JuliusMAAR, hosting identical second-stage payloads before they were reported for takedown.
The second-stage script uses a similar flow but appears to be obfuscated with MoonSec V3. It repeats geolocation checks, encrypts communications with the same XOR key, and uses EtherHiding again.
It also contains additional Polygon RPC fallback services, improving the malware’s resilience if one provider becomes unavailable.
Finally, the loader retrieves and launches the main payload. Netskope observed several infostealer variants in this stage, including the previously analyzed NodeJS-based MaaS malware.
Organizations should treat unexpected GitHub installation instructions, ZIP archives, renamed interpreters, and Lua scripts as potential warning signs.
Developers should verify repository ownership, compare download links with those on official project pages, use least-privilege cloud credentials, and rotate exposed API keys immediately.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
