Fake CVE Exploits Delivering SmartLoader

Security people download proof-of-concept exploits to test their own systems. Ten GitHub repositories named after real 2024–2026 vulnerabilities offer exactly that. What they deliver is 14 zip archives with no exploit inside, only a tiny launcher script, a renamed interpreter and an obfuscated script file.

• 12 of the 14 archives are detected by 13 to 50 antivirus engines on VirusTotal, five of them explicitly as SmartLoader. The other two were unknown to VirusTotal on 29 October 2026.
• All 10 repositories were still public on 29 October, and all 10 still carried an archive at a pinned commit on 30 October.
• Five of the archives were first seen by VirusTotal in a single week, 6–13 October 2026.

I did not extract or run any archive. Each was read into memory inside an isolated virtual machine only to compute its SHA-256 and list the file names in it.

The proven set was closed on 1 November 2026 with what had been found up to 31 October 2026, 17:59 UTC; repositories found after that are tracked separately and are not in these figures. The full proof pass at pinned commits ran on 30–31 October. On 1 November 2026, 18:23 UTC a read-only GitHub API recheck covered the 162 repositories, 73 accounts and 12 issues that are tracked one by one (operator repositories, Shai-Hulud accounts, phishing issues), not the whole set.

• Frozen: 10 repositories under 10 accounts.
• State: all public on 1 November, no new commits.

This is a floor: only 45 of the 9,432 repositories had their archives examined.

Read from the file lists only:

By public descriptions of SmartLoader, the .txt file is the obfuscated script the interpreter runs [1, 3]. I did not read it. VirusTotal's own sandbox tags most of the detected archives with debugger detection and long sleeps.

Twins. Two archives are each 487,683 bytes with identical entries (Application.bat 24 B, cli.exe 760,320 B, skey.txt 184,136 B). Two others are each 584,435 bytes with identical entries. Both pairs have different hashes.

Reuse. VirusTotal also records one archive as game-unnamed-v-1.3-beta.4.zip and another as App-OC-Streamlit-v2.0.zip. The CVE theme is one costume among several.

Calling all 14 "SmartLoader" is an inference for the nine without that label: they share the layout described for it. The two unknown archives match detected siblings exactly. Number 13 has the same 760,320-byte cli.exe as numbers 1 and 8. Number 7 has the same 488,960-byte lua51.dll and 292,864-byte executable as number 4.

Trend Micro first documented SmartLoader through fake GitHub repositories in March 2025 [1].

1. A proof of concept without source code is not a proof of concept. Real exploits ship Python, C or Go. A precompiled Windows tool in a random folder is hostile until proven otherwise.
2. Block by layout, not by hash: a tiny .cmd or .bat next to lua51.dll and a renamed interpreter, or a lone executable next to a several-hundred-kilobyte .txt.
3. "Not found on VirusTotal" is not a clean result. Two of these archives were unknown.
4. Run every third-party exploit in a disposable virtual machine with no saved credentials.

• No archive was extracted or run; behaviour comes from vendor labels and public reports.
• Vendor labels disagree on the family name.
• Only 45 of 9,432 repositories had their archives examined.
• Live state is a single check at 07:38 UTC on 29 October.

This article is part of the GitHub threat investigation. Counts are a snapshot, not evidence that the code ran on a victim's machine. The shared methodology and proof rules explain inclusion, exclusions and the independent re-check.