GitHub repository lures distribute a LuaJIT loader through poisoned README downloads
Huorong reports GitHub README download lures delivering a Windows batch/LuaJIT loader that uploads screenshots and system data, executes C2 responses and can fetch further stealers. Its sample spans 30,738 repositories and 15,584 accounts, including fakes and some hijacked accounts—not victim or infection counts.
- Disclosed
- Nov 4, 2026
- Public disclosure date
- Severity
- Sharted
- No CVE: a breach, not a bug
- Splash zone
- Windows users or coding agents executing ZIP/batch payloads linked by affected READMEs; browsing alone is not established as infection.
- GitHub · Malware · Supply chain
- In the wild
- Yes
- Huorong documents malicious repository distribution and some hijacked accounts.
What happened
The sample disguises downloads as AI tools and other projects; some repositories are fabricated or cloned, while some established accounts were hijacked according to Huorong. Running Launcher.cmd starts the renamed LuaJIT interpreter with uix.txt. The loader collects host identifiers and a screenshot, then evaluates transformed C2 responses as Lua code; later credential, chat-session or wallet theft depends on further components being delivered and run. This is not proof that every exposed repository infected a user or that GitHub’s platform infrastructure was breached.
Huorong counts over 56,000 malicious URLs by October 2026; its repository/account totals mix artifact types and cannot be added as victims or assumed to be all compromised accounts. The report does not identify a confirmed victim total, aggregate wallet loss or universal cleanup patch. L3 reflects a documented developer-download malware campaign; a ZIP on GitHub is not itself proof of installation or downstream data theft.
Crime-scene timeline
Nov 4, 2026
Huorong publishes original campaign analysis
Research covers activity monitored since 2025, with February and October 2026 bulk repository changes. November 4 is the report date, not the beginning of the campaign.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Huorong original November 4 research and indicator/appendix imagesPrimaryRepository/account/URL counts describe observed artifacts, not victims; sample reverse engineering, two C2s, one SHA256, seven conditional configuration fields and 20 illustrative malicious ZIP URLs were read, including image-only tables.