10,000 cloned GitHub repositories are serving a Trojan

An engineer searching Bing for their own GitHub project got back a different repository with the same name and description, every one of their commits copied into it, and their own account listed as a contributor. An hour earlier, a commit had added a link to a zip archive in the readme.

That repository, and a second one they found while browsing project tags, behaved identically. Every few hours they deleted the latest commit and pushed an identical one back, the only change being the zip link in the readme. They reported both to GitHub support, got two weeks of silence, and after another month saw GitHub remove them.

Download the archive and submit the link to VirusTotal and you get zero detections. Upload the zip file itself and VirusTotal flags a Trojan inside. The archive holds four files: a launcher (Application.cmd or Launcher.cmd), an executable (loader.exe, luajit.exe, or some other name), a data file (.cso or .txt), and lua51.dll. One of the referenced writeups calls the family “LuaJIT malware distributed via GitHub at scale.”

Finding the rest

GitHub holds roughly 500 million repositories and rate-limits a token to 5,000 API requests an hour, so crawling the whole set is impractical. Instead the author pulled daily event dumps from GH Archive, filtered to push events, and looked for repositories that get rewritten on a schedule. Across five days that was 16 million pushes, of which about 3,000 came from repos updated every few hours.

The first filter (updated 2 to 10 times per 10 hours, commits from a user not a bot, more than a month between the last two commits, more than one contributor) returned 14 repositories. That was suspiciously few, and on recheck all 14 had last updated 20 hours earlier, which meant the “every few hours” assumption had discarded the slower ones. Loosening it to repositories updated 1 to 24 times per 24 hours returned 40,000. Of those, 10,000 matched the full pattern, a quarter of the set. Each carries a zip with the Trojan, and some have been live for over a year.

Why the clones look legitimate

The author flags their read on the design as hypothesis. The clones target brand-new repositories rather than popular ones, because a fresh repo ranks quickly for low-volume search terms, and the operators also drop the clones into popular tags to help indexing. Copying the full commit history and contributor list, including the victim’s account, makes the page look established to anyone who clicks a profile and sees real history rather than a day-old account. Rewriting the commit every few hours and naming each one “Update README.md” may be aimed at GitHub’s detection heuristics.

What this means if you publish on GitHub

The URL trick matters. A scan of the archive link comes back clean while the zip itself trips detection, so any check that validates a download by URL alone gives a false pass.

GitHub is also not finding these on its own. GitHub deleted only the repositories in the published text-file list and nothing else, and a fresh run of the script turned up new repositories that were still live two weeks later. GitHub removes the repositories that get reported and does not appear to search for the rest.

Others have documented the same scheme. A February 2025 Reddit post warned that new repositories were being spoofed to host malware. An April writeup, “How 109 Fake GitHub Repositories Delivered SmartLoader and StealC,” found 109 such repos and attributes the payloads to SmartLoader and StealC. A piece titled “FakeGit: LuaJIT malware distributed via GitHub at scale” traces the operation from a smart contract deployed in March 2025 and documents the infrastructure, the IP addresses the Trojan contacts, and archive hashes with VirusTotal links. If you want to see candidates yourself, another writeup used the GitHub search query path:README.md /software-v.*.zip/ and found repositories whose readme had been updated 30 minutes earlier.