Agent Lure Stealer SmartLoader Campaign Analysis

The Agent Lure Stealer campaign is a multi-stage malware distribution operation active throughout late 2026, primarily targeting developers and AI researchers. The attackers leverage numerous fake GitHub repositories that masquerade as legitimate AI tools, MCP servers, and automation scripts. These repositories contain malicious ZIP archives that, once extracted, initiate an infection chain involving obfuscated Lua scripts and legitimate-looking launchers.

Technically, the campaign employs the 'EtherHiding' technique, using Polygon blockchain dead-drop resolvers to hide C2 infrastructure. The infection chain relies on LuaJIT (`util64.exe` or `luajit.exe`) to execute second-stage payloads like `dist.lua`, ultimately deploying the StealC infostealer. Persistence is maintained through the creation of masqueraded scheduled tasks that mimic common software update processes. The widespread abuse of legitimate services like GitHub and dRPC providers makes this campaign particularly challenging to block without granular monitoring.