FakeGit Campaign: Mitigating SmartLoader Malware Delivery via GitHub Supply Chain Attack

---
title: Potential SmartLoader Execution via GitHub ZIP
id: 8a2b1c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects the execution of scripts (Python, Node, PowerShell) from directories that are typically used for extracting downloaded GitHub archives. This is a primary TTP for the FakeGit campaign delivering SmartLoader.
references:
  - https://thehackernews.com/2026/07/fakegit-campaign-uses-7600-github.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.execution
  - attack.t1059.001
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\\python.exe'
      - '\
ode.exe'
      - '\\pwsh.exe'
      - '\\powershell.exe'
      - '\\cmd.exe'
  selection_path:
    CommandLine|contains:
      - '\\AppData\\Local\\Temp\'
      - '\\Downloads\'
      - '\\Temp\\Rar$'
  filter_legit:
    ParentImage|contains:
      - '\\Program Files\'
      - '\\ProgramData\'
    CommandLine|contains:
      - 'venv\'
      - 'node_modules\'
  condition: selection_img and selection_path and not filter_legit
falsepositives:
  - Developers actively testing code in their Download folders (high context dependency)
level: high
---
title: Suspicious GitHub Archive Download via CLI
id: 1b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects command-line usage of curl, wget, or Invoke-WebRequest to download ZIP archives from GitHub, often followed by execution in the FakeGit campaign.
references:
  - https://thehackernews.com/2026/07/fakegit-campaign-uses-7600-github.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.command_and_control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\\curl.exe'
      - '\\wget.exe'
      - '\\powershell.exe'
  selection_github:
    CommandLine|contains:
      - 'github.com'
      - 'codeload.github.com'
  selection_zip:
    CommandLine|contains:
      - '.zip'
      - '/archive/'
      - 'zipball'
  condition: selection_tool and selection_github and selection_zip
falsepositives:
  - Legitimate developers pulling specific versioned releases
level: medium

let GitHubDownloads = DeviceNetworkEvents
| where RemoteUrl has \"github.com\" and (RemoteUrl has \".zip\" or RemoteUrl has \"/archive/\");
let ProcessExecution = DeviceProcessEvents
| where Timestamp > ago(1h)
| where ProcessVersionInfoCompanyName != \"Microsoft Corporation\" // Filter out OS noise
| where FolderPath endswith \"\\\python.exe\" 
   or FolderPath endswith \"\\
ode.exe\" 
   or FolderPath endswith \"\\\powershell.exe\";
GitHubDownloads
| join kind=inner (ProcessExecution) on DeviceId, Timestamp
| where ProcessExecution.ProcessCommandLine has_any (\"AppData\\\Local\\\Temp\", \"Downloads\")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, ProcessCommandLine, FolderPath

-- Hunt for SmartLoader execution patterns from temp directories
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Exe =~ 'C:\\\Users\\\.*\\\AppData\\\Local\\\Temp\\\.*'
   AND Name in ('python.exe', 'node.exe', 'powershell.exe', 'cmd.exe')
   AND CommandLine !~ 'Program Files'

-- Supplemental: Hunt for recent ZIP files in Downloads
SELECT FullPath, Mtime, Size, Mode
FROM glob(globs='/*/*/Downloads/*.zip')
WHERE Mtime > now() - 24h

# PowerShell script to scan for suspicious execution artifacts related to FakeGit

# Check Event Log for Script Execution in Temp Directories (Past 24 Hours)
Write-Host \"[+] Scanning for suspicious script execution in Temp folders...\"
$events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue

$suspicious = $events | Where-Object { 
    $_.Message -match 'CommandLine' -and 
    $_.Message -match '(python\.exe|node\.exe|powershell\.exe)' -and 
    $_.Message -match '(AppData\\\Local\\\Temp|Downloads)'
}

if ($suspicious) {
    Write-Host \"[!] ALERT: Found suspicious process executions:\" -ForegroundColor Red
    $suspicious | Format-List TimeCreated, Message
} else {
    Write-Host \"[-] No immediate suspicious executions found in Security Log.\"
}

# Check User Downloads for recent ZIPs from GitHub
Write-Host \"[+] Scanning user Downloads for recent GitHub ZIP files...\"
$zipFiles = Get-ChildItem -Path \"$env:USERPROFILE\\Downloads\" -Filter \"*.zip\" -Recurse -ErrorAction SilentlyContinue | 
              Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-1) }

if ($zipFiles) {
    Write-Host \"[!] Found recent ZIP files in Downloads:\" -ForegroundColor Yellow
    $zipFiles | Select-Object FullName, LastWriteTime
    Write-Host \"[ACTION] Manually verify these files are legitimate before opening.\"
} else {
    Write-Host \"[-] No recent ZIP files found.\"
}