Key Takeaways
- Researchers uncovered roughly 7,600 malicious GitHub repositories in the ongoing FakeGit campaign, with over 800 masquerading as AI skills or Model Context Protocol (MCP) servers.
- These fake repos deliver the SmartLoader malware, which subsequently deploys the information‑stealer StealC to establish persistence and exfiltrate data.
- A new AI‑driven tactic, AgentBaiting, enables autonomous AI agents (e.g., Anthropic Claude Code, Google Gemini, OpenAI ChatGPT) to discover and execute the malicious payloads without human interaction.
- The campaign leverages familiar names and workflows of popular tools (Gmail, WhatsApp, Databricks, Jenkins, Docker) to make malicious ZIP files appear legitimate, guiding both users and agents into the infection chain.
- More than 600 fraudulent listings have appeared on public MCP/Skill registries such as LobeHub, Glama, MCP.so, and MCP Market, lending the threats a false sense of credibility.
- Defensive recommendations include maintaining a vetted catalog of skills/MCP servers, testing new agent capabilities in sandboxed environments, verifying publishers and projects, and monitoring agentic pathways to break the infection chain before execution.
Background of the FakeGit Campaign
Cybersecurity firm Island identified a large‑scale operation dubbed FakeGit that has flooded GitHub with nearly 7,600 malicious repositories. The campaign’s core strategy relies on social engineering: attackers copy legitimate projects, create lookalike developer profiles, and craft convincing README files that lure unsuspecting users into downloading trojanized ZIP archives. By mimicking popular AI‑related tools and MCP servers, the malicious repos appear trustworthy, increasing the likelihood of execution.
Structure of the Malicious Payloads
Each compromised repository contains a ZIP file that triggers a LuaJIT loader chain. This loader executes an obfuscated Lua script responsible for dropping the SmartLoader malware onto the victim’s system. SmartLoader’s primary function is to establish a foothold, after which it downloads and runs secondary payloads—most notably StealC, an information stealer capable of harvesting credentials, browser data, cryptocurrency wallets, and other sensitive files. The two‑stage approach maximizes stealth and data‑exfiltration potential.
Scale and Reach of the Infrastructure
The fake repositories were generated by approximately 6,600 distinct GitHub profiles. Of the total, more than 800 repositories posed as AI skills or MCP servers targeting individual and enterprise workflows, including integrations for Gmail, WhatsApp, Databricks, Jenkins, and Docker. As of July 2026, the campaign’s GitHub Release assets have amassed over 14 million downloads spread across roughly 200 active repositories, illustrating the broad appeal and effectiveness of the lure.
AI‑Powered Evolution: AgentBaiting
Beyond tricking human users, FakeGit has incorporated an AI‑driven technique termed AgentBaiting. When an AI agent searches for a skill or MCP server—such as requesting a “free claude cinematic prompt skill” or a “free walmart MCP server link”—it may inadvertently surface one of the bogus repositories. The agent then treats the attacker‑written README as legitimate documentation and follows the embedded instructions, thereby executing SmartLoader without any human prompting. Island’s testing showed that models like Anthropic Claude Code, Google Gemini, and OpenAI ChatGPT are all susceptible to this deception.
How AgentBaiting Works in Practice
The attack chain begins with a natural‑language query from an AI assistant. Because the malicious repositories are indexed in public code hosts and often listed on registries such as LobeHub, Glama, MCP.so, and MCP Market, the agent’s search algorithms rank them alongside genuine results. Upon selecting a fake repo, the agent reads the README, which contains seemingly normal installation steps (e.g., “unzip the file and run the setup script”). Those steps actually launch the LuaJIT loader, delivering SmartLoader and subsequently StealC. The entire process occurs autonomously, highlighting a new vector where AI agents become unwitting accomplices.
Exploitation of Public Registries
A troubling facet of FakeGit is its abuse of public MCP and Skill registries. More than 600 fraudulent listings have been identified across platforms like LobeHub, Glama, MCP.so, and MCP Market. These registries confer an aura of legitimacy because developers routinely browse them for trusted extensions. By injecting malicious entries into these trusted sources, attackers increase the chance that both human users and AI agents will encounter and trust the malicious code, thereby amplifying the campaign’s impact.
Defensive Measures Recommended by Researchers
To mitigate the threat, Island advises a multi‑layered approach. Organizations should first curate a vetted catalog of approved skills, MCP servers, and agent plugins, treating any new addition as untrusted until validated. New agent capabilities must be evaluated in isolated sandbox environments before broader deployment to observe behavior without risking production systems. Verification of both the publisher’s identity and the project’s provenance—such as checking commit histories, signed releases, and community feedback—is essential. Finally, continuous monitoring of agentic pathways (e.g., logs of API calls made by AI assistants) can help detect anomalous interactions with suspicious repositories before payload execution occurs.
Conclusion: The Changing Threat Landscape
FakeGit exemplifies how attackers adapt traditional social‑engineering tactics to exploit the rising reliance on AI‑assisted development workflows. By blending convincing repository facades with the autonomous discovery habits of AI agents, the campaign blurs the line between human‑targeted and machine‑targeted attacks. The emergence of AgentBaiting underscores the need for security strategies that account for AI agents as active participants in the software supply chain, ensuring that defenses intervene early in the infection chain—before any code, whether launched by a person or an AI, can run.