12 min read
SmartLoader: Lua-based malware delivered through cloned GitHub repositories
Stage-by-stage analysis of a SmartLoader campaign: cloned GitHub repos, a renamed LuaJIT runtime, EtherHiding C2 on Polygon, and a stealer that bypasses Chrome App-Bound Encryption.