SmartLoader
SmartLoader is a malware group described as known for spreading information stealers through fake installers. In the reported campaign, Straiker’s AI Research (STAR) Labs said the actor cloned a legitimate Oura MCP Server project and built a deceptive GitHub ecosystem with bogus forks, contributors, and likely AI-generated personas to make the project appear trustworthy. After establishing credibility, the actor published a separate trojanized repository and submitted the malicious package to public MCP registries so developers searching for Oura integrations would install it. The trojanized MCP server delivered the StealC information stealer and targeted developer credentials, browser passwords, cryptocurrency wallets, API keys, cloud credentials, and other user secrets. Reported tradecraft included use of LuaJIT, heavy VM-style obfuscation, and persistence via scheduled tasks disguised as Realtek drivers. The activity was characterized as a shift from targeting piracy users toward compromising developers through software supply-chain tactics focused on MCP ecosystems. Researchers stated the infrastructure and techniques matched known SmartLoader patterns and noted indicators suggesting China-based operations. No additional aliases or sub-groups were directly provided in the content beyond SmartLoader.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Software & Services
Where they're from
Attributed origin per open-source reporting.
- CN
Tradecraft
7 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
1 malware family attributed to this actor across reporting.
Recent activity
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.