The latest threat report from NetSkope, published on 2026-08-04, reveals a sophisticated Malware-as-a-Service (MaaS) operation that hijacks popular AI developer resources to deliver an infostealer payload. The campaign operates through cloned GitHub repositories that impersonate well‑known AI projects such as Claude, ComfyUI, and Python security guides. By embedding malicious code in seemingly innocuous text files, attackers convince developers to download and execute their payloads.

At the heart of the operation is a two‑stage SmartLoader chain. Stage one arrives as a four‑file ZIP containing Lua scripts obfuscated with Prometheus, while stage two uses MoonSec V3‑style obfuscation. Both stages resolve their command & control (C2) server dynamically through a smart contract on the Polygon blockchain. This EtherHiding technique allows operators to change the C2 IP address by updating a single value in the contract, eliminating the need for code redeployment and evading static detection.

Key tactics include:

• Social engineering via ClickFix: Users are lured into downloading ZIP files under the guise of “click‑to‑install” links that appear on GitHub readme pages.
• Repository impersonation: Attackers fork legitimate AI projects and add malicious subdirectories or alter installation URLs. The root page remains unchanged, preserving the original contributor metadata to build trust.
• Multi‑stage loader: Stage one performs geolocation reconnaissance and screenshot capture, then posts an XOR‑encrypted JSON beacon. Stage two downloads a second‑stage Lua script that re‑uses the same obfuscation and C2 resolution logic.
• Blockchain‑based dead‑drop: Both loaders issue eth_call requests to the contract 0x1823A9a0Ec8e0C25dD957D0841e3D41a4474bAdc via public RPC endpoints. The decoded response supplies the IP address of a remote HTTP stager.
• Persistence via scheduled tasks: The loader creates randomized Windows scheduled tasks for both itself and the final payload, ensuring execution on reboot without user interaction.

The malicious delivery package contains:

• lua51.dll – a LuaJIT 2.1 runtime that exposes luaopen_ffi, enabling dynamic API calls.
• compiler.exe – a renamed interpreter that executes the obfuscated script from gc.txt.
• Application.bat – orchestrates the launch of compiler.exe with gc.txt as an argument.
• gc.txt – a single line of Lua code heavily transformed by Prometheus. The script creates a self‑invoking function, uses newproxy to hide locals, and assembles strings at runtime via a 25 c() permutation sequence.

Once executed, the payload performs typical infostealer actions: credential harvesting for Windows credentials, browser cookies, and API keys stored in local files. It also enumerates installed software, capturing system details for profiling. The collected data is exfiltrated to the C2 endpoint established via the blockchain resolver.

Indicators of Compromise (IOCs) for this campaign include:

• Domain: ip-api.com
• Endpoints: hxxps://hxxp[s]://otx[.]alienvault[.]com/pulse/6a71b783e18524e9a67a3110, hxxps://hxxp[s]://netskope[.]com/blog/developers-in-the-crosshairs-fake-ai-tools-deliver-infostealer
• GitHub URLs: hxxps://hxxp[s]://github[.]com/yawalinte/80, hxxps://hxxp[s]://github[.]com/JuliusMAAR/gpt-re

Recommendations for defenders:

1. Validate GitHub repositories: Verify the commit history and signatures before cloning or installing from a public repo. Use automated tools to detect forked projects that have been tampered with.
2. Block blockchain queries: Deploy network segmentation rules that restrict outbound eth_call traffic to known Polygon RPC endpoints, or use URL filtering to block access to contract addresses used by the campaign.
3. Enforce strict download policies: Configure web filters to flag ZIP files with embedded Lua scripts and block execution of unknown batch files.
4. Monitor C2 beacon traffic: Look for outbound HTTP POSTs that contain base64‑encoded or XOR‑encrypted JSON payloads, especially those that include screenshot images.
5. Patch and harden endpoints: Disable legacy Windows API calls used by the malware (e.g., CreateProcessW with unknown executables) through application whitelisting.

The campaign demonstrates how attackers can blend legitimate developer tools with malicious payloads, leveraging supply‑chain confidence to spread infostealers. By using dynamic C2 resolution and multi‑stage loaders, they achieve high resilience against blacklisting. Organizations should treat developers as high‑value targets and adopt a zero‑trust posture when handling code from external sources.