Netskope Threat Labs details SmartLoader delivery using Polygon blockchain C2 resolution in a developer infostealer campaign

In April 2026, Netskope Threat Labs reported a Malware-as-a-Service campaign that now targets AI users and developers by impersonating GitHub repositories and delivering an infostealer via multi-stage SmartLoader with runtime Polygon-based C2 resolution. The findings matter to enterprise security teams because they describe repeatable lures and loader-chain behaviors that can inform detection and response.

Research Overview

Netskope Threat Labs tracked a NodeJS MaaS infostealer originally delivered using the ClickFix social engineering technique and found additional campaigns that changed delivery methods. The new activity focuses on cloning and redirecting downloads from impersonated GitHub repositories associated with a larger TroyDen lure-factory effort.

Targets were identified across North America, Asia, and Southern Europe, with financial services, banking, and technology sectors reported as leading segments. Netskope also described the campaign as targeting AI users and developers by cloning AI- and development-related resources and tools.

Key Findings

The campaign uses trojanized GitHub repositories as lures, with attacker modifications to appear authentic while integrating malicious payloads into repositories that host AI resources. Netskope said the lures include items such as Claude, ComfyUI, AI coding assistant materials, Python security guides, and Rust frameworks.

Netskope reported that delivery relies on SmartLoader deployed in a redundant loader chain, with SmartLoader used twice rather than as a single stage. Both loaders resolve the C2 server address at runtime from the Polygon blockchain using EtherHiding.

Technical Breakdown

For stage 1, Netskope described a four-file zip where the malicious Lua component is run from a LuaJIT 2.1 runtime and obfuscated using Prometheus, with indicators such as a self-invoking wrapper, a Prometheus-specific proxy pattern, and a virtual-machine dispatch structure. The stage also includes a batch script that runs a renamed LuaJIT interpreter against an additional text file that holds the obfuscated logic.

SmartLoader stage 1 begins with geolocation collection by calling ip-api.com and then sends a screenshot using Windows GDI APIs such as GetSystemMetrics, CreateDIBSection, and BitBlt. Netskope said the loader beacon includes a screenshot and a JSON beacon containing fields including loaderID, GUID, public IP, and OS version, with XOR-encrypted egress and response using a key recovered from memory.

For C2 communication, Netskope said both loaders use an eth_call to query a Polygon smart contract, decoding the ABI response to obtain a stager IP address and treating the contract values as a dead-drop resolver. Stage 1 then processes a JSON response containing encrypted loader configuration and task instructions, including a persistence task implemented as a scheduled task with randomized timing and a task name.

Netskope described stage 2 as a second-stage Lua script downloaded by stage 1, along with a bundled LuaJIT interpreter and DLL runtime from GitHub. Netskope said the script is consistent with the MoonSec V3 obfuscator and that stage 2 repeats behaviors from stage 1, including reuse of the XOR key, geolocation reconnaissance, and EtherHiding-based C2 IP hiding, while adding additional Polygon RPC provider fallbacks.

Operational Impact

Netskope said the campaign uses multi-stage loaders that share a similar attack flow while rotating delivery vectors through cloned and impersonated GitHub repositories. This includes redirecting download links to payloads and using two instances of SmartLoader so that C2 targeting changes can occur without modifying malware code.

Netskope framed the reported rationale for targeting developers as related to typical access to source code, cloud credentials, API keys, code-signing certificates, and CI/CD pipelines, which it associated with software supply chain attack potential. The activity documented by Netskope Threat Labs was tied to EtherHiding and Polygon-based runtime C2 resolution as mechanisms for IP rotation without code changes.

Blog Signals brief is a fact-based summary of the vendor blog that describes Netskope Threat Labs’ April 2026 reporting on a developer-focused MaaS infostealer delivery chain, including trojanized GitHub lures and SmartLoader stages with Polygon blockchain C2 resolution. The details are relevant for enterprise IT and security leaders seeking to understand how loader redundancy, GitHub impersonation, and blockchain-based C2 address resolution appear together in observed campaigns.

Source: netskope.com, by Jan Michael Alcantara.