Developers in the Crosshairs: Fake AI Tools Deliver Infostealer

MITRE Techniques

• [T1566.002 ] Phishing: Spearphishing Link – Victims were lured through impersonated GitHub repositories and ClickFix-style delivery links (‘delivering payloads via impersonated GitHub repositories hosting popular AI resources’).
• [T1189 ] Drive-by Compromise – The attackers redirected download links inside trusted-looking GitHub pages to deliver malicious payloads (‘modifying the URLs on the installation instructions’).
• [T1105 ] Ingress Tool Transfer – Stage 2 downloaded the next payload and supporting components from GitHub repositories (‘instructed to download the second-stage Lua script stager file along with a bundled LuaJIT interpreter and DLL runtime’).
• [T1027 ] Obfuscated Files or Information – The Lua payloads were heavily obfuscated with Prometheus and MoonSec (‘obfuscated using Prometheus’ and ‘likely obfuscated using MoonSec’).
• [T1027.016 ] Binary Padding – The stage 2 payload used a pump setting to alter file size and evade detection (‘pump’: {‘size’: 700, ‘status’: true}).
• [T1055 ] Process Injection – Not explicitly used; no clear process injection was described in the article.
• [T1106 ] Native API – The malware used Windows APIs such as GetSystemMetrics, CreateDIBSection, BitBlt, and CreateProcessW to collect data and launch stages (‘uses GetSystemMetrics … CreateProcessW directly’).
• [T1082 ] System Information Discovery – SmartLoader gathered victim IP, country, city, time zone, ISP, and OS version (‘retrieve the victim’s IP address, country, city, time zone, and ISP’).
• [T1113 ] Screen Capture – SmartLoader captured the victim’s screen using GDI APIs (‘takes a screenshot of the victim’s device using the GDI API’).
• [T1102 ] Web Service – The loader used ip-api.com and public RPC providers as external services for geolocation and C2 resolution (‘sending a GET request to ip-api.com/json’ and ‘hardcoded public RPC providers’).
• [T1568.001 ] Dynamic Resolution: Fast Flux DNS – Not directly DNS-based; C2 was dynamically resolved via blockchain instead of DNS (‘resolve the IP address at runtime’).
• [T1001 ] Data Obfuscation – The beacon and C2 response were XOR-encrypted to hide traffic content (‘XOR-encrypted JSON beacon’).
• [T1098 ] Account Manipulation – Attackers cloned and impersonated GitHub accounts to host payloads (‘We identified two GitHub accounts serving identical payloads’).
• [T1053.005 ] Scheduled Task/Job: Scheduled Task – Persistence was established using a scheduled task (‘used a scheduled task for persistence’).
• [T1204.002 ] User Execution: Malicious File – Execution depended on the victim running the downloaded archive and scripts (‘when the batch script runs compiler.exe with gc.txt as an argument’).