GCVE-110-OSM-2026-14587

GitHub repository that provides the advertised functionality, typically cloned from a legitimate project, but also ships Windows malware. It includes a ZIP "installer" that, once run, starts a loader called SmartLoader, which usually drops the StealC infostealer. Part of a campaign that spreads malware through GitHub repositories imitating popular AI agent tools such as Claude skills, Codex tools, and MCP servers. Identified in research by SecurityBreak.io. ## Payload 1: committed ZIP installer Malicious payload found in: `maddish/messenger-codex-v2.6.zip` - Trigger: the victim downloads and runs the ZIP "installer" shipped in the repository (Windows users are told to click past the "Windows protected your PC" prompt). - ZIP SHA-256 (messenger-codex-v2.6.zip): `53039bdeb3e155236dce324281f59846c2da7518a54859c409286aaff86d61a2` - Contents: `Application.bat` launcher (`4f5c5ad522d8dba60e89c443e07d65c3ce373ef1a617d220d3b69a185c11dae2`), `util64.exe` LuaJIT runtime (`7ad4b911d05a12f91ab27ba3baa351a56653ca099dda7ad87ee2b94f8cd018c9`), `lua51.dll` (`04d3c82782927330d56827ff551697666dbab4b3abf5b86bde492efdd142bc58`), and `lfs.txt`, an obfuscated Lua script (`2a7afb187157a4052e5b9797d1d1c7ee807b2edeffef076a08b20b12e3dcf317`). - Behavior: the launcher runs the Lua script with the bundled runtime (SmartLoader). A sandbox run dropped a second stage `dist.lua` (`ad9da27f72bb7abbfcba92f9302d3467f5487814bb34bbf4b1573abcb56e4efc`) to the Temp folder. - Persistence: scheduled tasks `CCleanerSkipUAC_7d7757` (runs `%LOCALAPPDATA%\7d7757\7d7757.exe lfs.txt`) and `OfficeClickToRunTask_7d7752` (runs `%LOCALAPPDATA%\7d7752\7d7752.exe dist.lua`). - Other dropped files: `%LOCALAPPDATA%\Programs\Py\Selenium\Selenium.exe` and `C:\Windows\Setup\Scripts\ErrorHandler.cmd`. - Repository status on 2026-11-04: live.