🕵️ SmartLoader

The items that name it 2

• FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware
  article

  Loader malware delivered via FakeGit campaign, used to establish persistence and push secondary payloads like StealC; deployed via a LuaJIT loader chain executing an obfuscated Lua script.

• AgentBaiting: How Fake AI Skills Deliver Malware at Scale
  writeup

  Malware delivered via FakeGit malicious ZIP files; establishes persistence and installs StealC. Delivery chain: a small .cmd/.bat launcher, a LuaJIT-style runtime (e.g., luau.exe), and an obfuscated Lua payload disguised as a text/icon/license/data file (e.g., ico64.txt), which hides the console win