SmartLoader is a malware loader distributed primarily through fake or cloned GitHub repositories that impersonate legitimate projects, including open-source software, game cheats, cracked software, cryptocurrency utilities, IT software projects, AI tools, and trojanized MCP/Oura-related repositories. Public reporting cited in the content indicates this delivery tactic has been in use since at least early 2025, and SmartLoader was first highlighted by OALABS Research in early 2024. Campaigns described in the content used polished or AI-generated repository descriptions, fake forks and contributor ecosystems, SEO terms, malicious README download links, and ZIP archives hidden in repository folder structures to increase trust and visibility.
In the observed infection chain, a downloaded ZIP archive contains a simple batch script that launches a legitimate LuaJIT interpreter to execute a heavily obfuscated Lua script constituting SmartLoader. Reported behavior includes hiding its console window via Windows API calls, anti-debugging shellcode executed from allocated memory, resolving active command-and-control infrastructure through a Polygon blockchain dead-drop mechanism using polygon.drpc.org, and sending host fingerprinting data and screenshots to a bare-IP C2 via multipart POST. The C2 returns encrypted instructions and tasks. SmartLoader establishes persistence through two scheduled tasks, including examples such as "AudioManager_ODM3" and "OfficeClickToRunTask_7d7757"; one task runs a cached local Lua stage while another re-downloads an encrypted stage from an attacker-controlled GitHub repository. In another reported campaign, persistence was disguised as Realtek driver-related scheduled tasks.
SmartLoader is used to retrieve and deploy follow-on payloads, including StealC, Lumma Stealer, and in other reporting as a dropper for Rhadamanthys. The Hexastrike reporting in the content states SmartLoader could decrypt and load StealC directly into memory without writing it to disk. Associated follow-on theft objectives described in the content include browser passwords, credentials, cookies, API keys, cloud credentials, cryptocurrency wallets, login codes, and other sensitive data. Reported targeting spans general GitHub users, retro gaming and PlayStation Vita modding users, offensive security professionals in the AIRedScam campaign, and developers using MCP-enabled AI tooling, who are considered high-value targets because their systems may contain production access and secrets.
High-confidence infrastructure and hunting details directly mentioned in the content include a SmartLoader URL pattern of a direct IP address with a /task/ folder and a 40-character filename with no extension; one campaign-associated C2 IP of 85.137.52.21; the associated domain voistace.github.io; and use of polygon.drpc.org for blockchain-based C2 resolution. Threat activity in the content is linked to fake GitHub repository ecosystems and, in one Straiker report, indicators suggesting China-based operations, though attribution is not definitive.
