A large-scale operation dubbed 'FakeGit' is pushing SmartLoader and StealC malware through 7,600 malicious GitHub repositories that accumulated more than 14 million downloads. [...]
FakeGit campaign uses 7,600 GitHub repos to push SmartLoader malware
Summary + source link. No paywalls, no tracking.