Massive GitHub Campaign Spreads Trojan Through 300+ Fake AI Tool Packages

Uncover "TroyDen's Lure Factory," a malware campaign using fake GitHub packages to target developers and gamers with sophisticated tactics.

By Content Team

Mar 25, 2026

ON THIS PAGE

Cybercriminals are running a sophisticated campaign called "TroyDen's Lure Factory" that spreads malware through over 300 fake GitHub packages targeting developers and gamers. The attack centers on a bogus OpenClaw Docker deployer but includes various lures like game cheats, crypto bots, and VPN crackers.

The malware uses a clever two-part design with a renamed Lua runtime and encrypted script that evades detection when analyzed separately. Once both components run together, it takes screenshots, steals credentials, and sends data to servers in Frankfurt.

Netskope researchers discovered the campaign in March and notified GitHub, though some malicious repositories remain active. The attackers appear to use AI assistance, evidenced by systematically generated package names using obscure scientific terminology.

Source: Dark Reading

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?