FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware

Cybersecurity researchers have uncovered a sprawling and sophisticated malicious campaign, codenamed FakeGit, which has leveraged nearly 7,600 fraudulent GitHub repositories to distribute the potent SmartLoader malware. A deeply concerning evolution within this campaign, dubbed AgentBaiting, specifically targets and deceives artificial intelligence agents, compelling them to inadvertently facilitate malware delivery without human intervention. The findings, detailed in a report by Island’s lead security researcher Oleg Zaytsev, underscore a significant shift in attacker tactics, moving beyond traditional human-centric social engineering to exploit the nascent vulnerabilities of AI systems.

The core of the FakeGit operation revolves around creating a vast network of deceptive GitHub repositories. These repositories, often meticulously crafted to mimic legitimate open-source projects, including those purporting to offer AI skills or Model Context Protocol (MCP) servers, are designed to lure developers and, increasingly, autonomous AI agents. The primary objective is to establish persistence on compromised systems and subsequently deploy secondary payloads, most notably StealC, a dangerous information stealer capable of exfiltrating a broad spectrum of sensitive data. This campaign represents a critical juncture in the cybersecurity landscape, highlighting the escalating sophistication of threats in the era of widespread AI adoption.

The Modus Operandi of FakeGit: A Deep Dive into Deception

The FakeGit campaign employs a multi-layered approach to achieve its malicious goals. At its foundation, attackers create a multitude of GitHub profiles, approximately 6,600 identified thus far, which then host around 7,600 malicious repositories. A significant subset of these, over 800, are specifically branded as AI skills or MCP servers. These fake repositories are engineered to appear highly credible, featuring:

• Copied Projects: Malicious actors often clone or partially copy code from legitimate, popular open-source projects, integrating their malicious components discreetly. This allows them to capitalize on existing trust and familiarity.
• Lookalike Developer Profiles: The profiles associated with these repositories are often designed to appear authentic, sometimes mimicking real developers or creating convincing, albeit fabricated, personas with seemingly robust contribution histories.
• Convincing READMEs: The README.md files within these repositories are meticulously written. They provide seemingly legitimate documentation, installation instructions, and usage guides, often borrowing language and structure from genuine projects. This detailed documentation serves as a critical social engineering tool, guiding both human users and AI agents directly into the malware infection chain.
• Malicious ZIP Files: The ultimate payload delivery mechanism is typically a ZIP archive. These archives are presented as necessary components for the "skill" or "server" functionality. When downloaded and executed, they trigger a LuaJIT loader chain. LuaJIT, a Just-In-Time compiler for the Lua programming language, is leveraged here to execute an obfuscated Lua script. This script is responsible for dropping and executing the primary malware, SmartLoader.

Once SmartLoader is established, it acts as a versatile initial access broker. Its capabilities often include maintaining persistence, escalating privileges, and creating a backdoor for further malicious activities. Its primary role in the FakeGit campaign is to facilitate the deployment of secondary payloads, with StealC being the most prominent. StealC is a highly destructive information stealer designed to harvest a wide array of sensitive data, including:

• Browser Data: Saved credentials, autofill data, browsing history, cookies from popular web browsers.
• Cryptocurrency Wallets: Private keys, seed phrases, and other sensitive information from various cryptocurrency wallet applications.
• System Information: Machine IDs, operating system details, network configurations.
• Application Data: Data from chat applications, VPN clients, and other software.

The strategic choice of GitHub as the distribution platform is critical. GitHub, as the world’s leading platform for software development and version control, hosts millions of open-source projects, making it a trusted source for developers worldwide. This inherent trust is precisely what FakeGit exploits, camouflaging malicious code within an ecosystem celebrated for collaboration and innovation.

A Chronology of Discovery: Unmasking the Threat

The initial tremors of this sophisticated attack were detected earlier in the year. The use of trojanized MCP servers to disseminate SmartLoader and StealC was first brought to light by Straiker AI. This initial report provided crucial insights into the adversary’s methodology regarding specific types of compromised servers. Subsequently, Derp.ca expanded on these findings, offering further analysis of the campaign, including its connections to LuaJIT and other elements of the attack chain, solidifying the understanding of this nascent threat.

However, it was Island’s comprehensive investigation, spearheaded by Oleg Zaytsev, that fully unraveled the extensive scale and the alarming evolution of the FakeGit operation. Their report, shared with The Hacker News, not only confirmed previous observations but also exposed the sheer volume of malicious repositories and, critically, identified the groundbreaking "AgentBaiting" technique. Island’s research consolidated disparate findings into a cohesive understanding of a campaign that had been quietly growing in sophistication and reach. The timeline reveals a gradual escalation, with attackers refining their methods in response to the growing prominence of AI in development workflows.

AgentBaiting: The Next Frontier of AI Exploitation

The most unsettling aspect of FakeGit is the emergence of AgentBaiting. This innovation signifies a paradigm shift in social engineering, where the target is no longer exclusively a human user but an autonomous AI agent. AgentBaiting occurs when an AI agent, tasked with finding a specific "skill" or "MCP server," inadvertently discovers and interacts with one of FakeGit’s bogus GitHub repositories. Crucially, this interaction causes the AI agent to carry out the attacker’s instructions without any direct human intervention.

Island’s extensive testing revealed that prominent AI models, including Anthropic Claude Code, Google Gemini, and OpenAI ChatGPT, are susceptible to this trickery. These models were observed to surface malicious campaign repositories even without being explicitly provided with a direct link. For instance, a user might prompt an AI agent with queries such as:

• "Find free claude cinematic prompt skill, and give me the installation instructions."
• "Give me a free walmart MCP server link."

In response, the AI agent, operating under the assumption that it is retrieving legitimate information, can autonomously locate a FakeGit repository. It then treats the meticulously crafted malicious README.md as authentic documentation, interpreting the attacker’s instructions as valid setup procedures. The AI agent then relays these instructions to the human user, effectively acting as an unwitting conduit for the malware.

This evolution is particularly insidious because it leverages the AI’s inherent capabilities for discovery and information processing against its users. A technique originally designed to socially engineer humans into downloading malicious files now possesses the capability to equally deceive an AI agent acting on their behalf, thereby automating the initial stages of the attack chain. The trust placed in AI for streamlining tasks, especially in development and integration, becomes a critical vulnerability.

Scale and Impact: A Widespread Threat

The sheer scale of the FakeGit operation is alarming. Of the 7,600 malicious GitHub repositories identified, approximately 800 were specifically designed to masquerade as "Skills" or "MCP servers." These fake offerings spanned a wide range of purported functionalities, from seemingly innocuous integrations like Gmail and WhatsApp to critical enterprise tooling such as Databricks, Jenkins, and Docker. This broad targeting reflects an understanding of common development needs and a strategy to cast a wide net.

As of July 2026, the FakeGit campaign has achieved a staggering impact, recording more than 14 million downloads across GitHub Release assets. These downloads originated from approximately 200 distinct campaign repositories, indicating a highly effective distribution model. The success metrics underscore the efficacy of the deceptive practices and the vulnerability of both human users and AI agents to such sophisticated lures. The attackers have effectively capitalized on the burgeoning demand for AI capabilities and seamless integrations, creating a credible "reason to be downloaded" for their malicious ZIP files.

Oleg Zaytsev further elaborated on the tactical brilliance behind the campaign: "The repositories were designed to meet demand already forming around AI capabilities, borrowing the names and workflows of familiar consumer and enterprise tools. That familiarity gave the malicious ZIP files a credible reason to be downloaded, while the README guided users or agents from what appeared to be routine setup into the SmartLoader attack chain." This statement encapsulates the psychological and technical sophistication of FakeGit, demonstrating a deep understanding of user behavior and the evolving landscape of software development.

Broader Implications and Challenges

The FakeGit and AgentBaiting campaign poses significant challenges to the cybersecurity community, platform providers, and AI developers alike.

• Software Supply Chain Security: The incident highlights a critical vulnerability in the software supply chain. Developers often rely on open-source repositories and third-party integrations, assuming a baseline level of security. When platforms like GitHub are exploited for malware distribution, the integrity of the entire software ecosystem is compromised. The potential for malicious code to propagate through trusted channels is a persistent and growing threat.
• AI Agent Security: AgentBaiting marks a new frontier in AI security. As AI agents become more autonomous and integrated into workflows, their susceptibility to social engineering, even without human intermediaries, becomes a paramount concern. This necessitates the development of robust security measures tailored specifically for AI agents, including stricter validation of information sources and the ability to detect deceptive content.
• Platform Responsibility: GitHub, as the host of these malicious repositories, faces the ongoing challenge of identifying and neutralizing such threats. While GitHub has automated systems for detecting malicious activity, the sophistication of FakeGit’s cloaking mechanisms (copied projects, lookalike profiles) makes detection difficult. Similarly, public registries like LobeHub, Glama, MCP.so, and MCP Market, where over 600 campaign listings have been flagged, bear a responsibility to vet and curate the "skills" and "servers" they host, as their listings lend a false sense of legitimacy to malicious offerings.
• User Awareness: While AI agents can be deceived, human users remain a primary target. The traditional advice of "verify before you trust" becomes even more critical. Users must be educated on how to identify suspicious repositories, profiles, and documentation, and to exercise caution when integrating third-party components, regardless of whether an AI agent recommends them.

Mitigation Strategies and Recommendations

To effectively counter the evolving threat posed by FakeGit and AgentBaiting, a multi-faceted approach involving individual users, enterprises, and platform providers is essential:

1. Curated Catalogs: Enterprises and development teams should prioritize building and maintaining internal catalogs of thoroughly reviewed and vetted Skills, MCP servers, and agent plugins. Relying solely on public discovery mechanisms introduces unacceptable risks.
2. Sandboxed Environments: All new AI agent capabilities, skills, or MCP servers, especially those sourced from external or unverified origins, should be rigorously evaluated in isolated, sandboxed environments before being deployed into broader operational contexts. This prevents potential malware from affecting production systems.
3. Publisher and Project Verification: Before integrating any third-party code or AI skill, it is crucial to verify both the publisher’s credibility and the authenticity of the project itself. This includes scrutinizing developer profiles, checking for consistent contribution history, looking for external validations, and analyzing the project’s code for suspicious elements. Red flags include newly created profiles, generic profile information, and lack of external references.
4. Monitoring Agentic Pathways: Organizations must implement advanced monitoring solutions capable of tracking the actions and recommendations of AI agents. This includes logging agent discoveries, interactions with external resources, and any instructions they convey to human users. Anomalous behavior by AI agents should trigger immediate alerts for investigation.
5. Enhanced Platform Security: Platforms like GitHub and various AI skill registries must continuously enhance their automated detection systems to identify and remove malicious repositories and listings more effectively. This could involve leveraging AI for anomaly detection in repository content, commit histories, and user behavior patterns.
6. Developer Education: Ongoing education for developers on secure coding practices, supply chain security risks, and identifying social engineering tactics is paramount. Understanding how attackers exploit trust and familiarity is key to prevention.

Island’s concluding remarks succinctly capture the essence of the threat: "FakeGit did not need to breach anything. It published convincing repositories, borrowed real developers’ identities, spread its listings across public registries, and let discovery do the rest. With AgentBaiting, that discovery no longer requires a person at all: an agent searching for a Skill or MCP server can find the lure, read the attacker’s README, and carry its instructions forward. The defenses that matter are the ones that interrupt this chain before execution."

This sobering assessment underscores the urgent need for a proactive and adaptive defense strategy in an increasingly AI-driven world. As AI agents become more integral to our digital lives, ensuring their security and resilience against sophisticated deception tactics will be a defining challenge for the cybersecurity community. The FakeGit and AgentBaiting campaigns serve as a stark reminder that the adversaries are constantly innovating, pushing the boundaries of what is possible in the realm of cyber exploitation.