THE SCAM
The free download that steals your passwords.
You find a tool you need on GitHub — maybe an AI helper or a handy utility — and the page looks perfectly legit. A polished README walks you through setup with a big "Download" button. But thousands of these repositories are fake, and that button hands you a ZIP file that installs malware called SmartLoader, which then drops an infostealer named StealC that harvests your saved passwords, logins, and browser data.
Security researchers at Apiiro report the campaign, called FakeGit, reactivated on October 4 and now runs 17,610 malicious repositories — pushing more than 13,000 of them in just 34 hours at a peak of nearly 3,000 an hour. At least 700 of the accounts involved appear to belong to real developers, which makes the fakes harder to tell apart from the real thing.
THE RED FLAG
Look at what the fake repos actually contain. In the samples Apiiro checked, 97% changed only the README — there is no real code being shared, just a convincing instruction page — and 88% of the "Download" buttons pointed at the malicious ZIP. A polished page is not proof the file is safe; here, the page is the entire con.
The other flag is how stubbornly it survives. Takedown lists only cover a fraction of the repos, and when one download link is removed the operators just re-aim the button at a backup copy hiding in a fork, a release asset, or an issue attachment. If a download works after the source looks dead, that is not good luck — that is the setup.
THE RULE
Never install a tool from a random repository just because the README looks professional. Check who owns the repo — how long the account has existed, what else it has published — and if it is an AI skill or add-on, get it from the official registry or the vendor's own repository instead of a search result.
If you already downloaded and ran something suspicious from GitHub, treat your accounts as exposed: change your important passwords, revoke active sessions and app tokens, and turn on passkeys where your accounts offer them. A download button is cheap. Your logins are not.
(Source: BleepingComputer, October 2026 (Apiiro report on the FakeGit campaign))
SIGN-OFF
That's today's red flag. One scam, one red flag, one rule — pass it to someone who clicks first and asks questions later.
Got a scam text or a sketchy email? Send it via the contact page — the best ones make future red flags.