Fake AI Tools Target Developers With Infostealers to Steal Credentials and Cloud Secrets

A large-scale malware campaign targeting developers and AI users has been uncovered ,revealing how attackers are weaponizing fake AI tools and cloned GitHub repositories to distribute infostealers and exfiltrate sensitive data.

The latest evolution shows a clear tactical shift. Instead of relying solely on social engineering prompts, threat actors are now impersonating legitimate GitHub repositories associated with popular AI frameworks and developer utilities.

These malicious repositories, linked to a broader campaign known as “TroyDen’s lure factory” mimic trusted projects such as Claude integrations, ComfyUI tooling, Python security guides, and Rust development frameworks.

By preserving original repository structure and contributor metadata, attackers significantly increase the likelihood of successful compromise.

The infection chain is notable for its modular, multi-stage architecture built around SmartLoader, a loader increasingly observed in developer-focused malware campaigns.

Victims downloading trojanized packages receive a compressed archive containing Lua-based components, including a malicious script disguised as a benign text file.

Execution is triggered via a bundled LuaJIT interpreter, allowing attackers to dynamically assemble and execute payloads in memory while evading static detection.

A key innovation in this campaign is the use of dual SmartLoader stages, each employing different obfuscation frameworks.

The first stage leverages Prometheus obfuscation, while the second stage appears to use MoonSec, complicating reverse engineering efforts.

Netskope Threat Labs Researchers documented a NodeJS-based Malware-as-a-Service (MaaS) infostealer delivered via ClickFix social engineering techniques.

The staged design enables flexible payload delivery, persistence establishment, and task execution without exposing the full attack chain at once.

More significantly, both loader stages utilize EtherHiding, a technique that resolves command-and-control (C2) infrastructure dynamically via the Polygon blockchain.

Instead of hardcoding IP addresses or domains, the malware queries a smart contract at runtime to retrieve the active C2 endpoint.

This approach allows operators to rotate infrastructure instantly by updating blockchain-stored values, eliminating the need to redeploy malware.

Fake AI Tools

Such decentralization presents a major challenge for defenders, as traditional blocklisting becomes ineffective.

Once executed, SmartLoader performs reconnaissance by querying geolocation APIs, capturing screenshots via Windows GDI functions, and transmitting encrypted beacon data to the resolved C2 server.

The malware then retrieves additional payloads hosted on attacker-controlled GitHub accounts, including repositories such as “yawalinte” and “JuliusMAAR,” which were rapidly created and rotated to evade takedowns.

The final stage delivers various infostealers, including the previously analyzed NodeJS MaaS variant. These payloads are designed to extract high-value data from developer environments, including API keys, cloud credentials, browser-stored secrets, and access tokens tied to CI/CD pipelines.

Given developers’ elevated privileges, successful compromise can enable downstream supply chain attacks, codebase manipulation, or unauthorized infrastructure access.

The campaign primarily targets organizations across North America, Asia, and Southern Europe, with a strong focus on financial services, banking, and technology sectors.

Its emphasis on AI tooling reflects the growing attack surface introduced by rapid AI adoption, where developers frequently rely on open-source components and experimental frameworks.

This operation highlights a broader trend in adversary behavior: blending social engineering with supply chain compromise and decentralized infrastructure.

By abusing trusted platforms like GitHub and resilient technologies like blockchain, attackers are achieving both scalability and stealth.

As MaaS ecosystems continue to mature, campaigns like this demonstrate how quickly threat actors can adapt delivery mechanisms while maintaining consistent payload objectives.

Netskope researchers note that this campaign remains active and evolving, underscoring the need for stricter repository validation, runtime behavioral detection, and enhanced scrutiny of third-party AI tooling in development workflows.

$1M Data Breach Warranty is Genuine Protection?: Download 10 Point Free AI SOC Breach Warranty Guide