Never Deleted, Only Re-Pointed: Inside the 17,600-Repo FakeGit Fleet That Re-Arms Overnight
Following README link changes across the FakeGit software-supply-chain campaign.
Open the original ↗
A persistent distribution mechanism
FakeGit examines a malware-distribution campaign built around convincing GitHub repositories. The repository could stay in place while a README link changed to point visitors at a new payload location.
The investigation connects those updates across the fleet, documenting campaign evidence and repository-update patterns. Figures in the original article describe the observed fleet at publication time, rather than a live count.