FakeGit campaign uses 7,600 GitHub repos to push SmartLoader malware

An Evolving Threat Landscape: The Rise of FakeGit

The FakeGit campaign represents a significant escalation in the tactics employed by cyber adversaries. Researchers at cybersecurity firm Trend Micro have identified this operation as a continuation of an earlier campaign that utilized the Lumma Stealer malware, which they attributed to a persistent threat actor tracked as "Water Kurita." This attribution underscores the continuous evolution and increasing sophistication of established cybercriminal groups, adapting their methodologies to exploit emerging technological trends and vulnerabilities.

Initial phases of the campaign likely relied on more traditional social engineering techniques to lure victims. However, the latest iteration, as detailed by researchers at the enterprise browser platform Island, marks a strategic pivot. The introduction of an intense focus on AI-themed lures began in March, rapidly escalating to a peak in April, during which approximately 300 GitHub repositories explicitly linked to AI tools were created. This rapid expansion saw the number of AI-related malicious repositories surge to over 1,400, all designed to distribute either SmartLoader or StealC malware.

These repositories were meticulously crafted to appear legitimate, often impersonating popular consumer and enterprise tools such as Gmail, WhatsApp, Databricks, Jenkins, and Docker. The threat actors invested considerable effort in creating convincing facades, including fabricated star and fork counts, meticulously copied project descriptions from genuine repositories, and even leveraging real developer account names to enhance credibility. Such attention to detail makes these malicious repositories exceedingly difficult to distinguish from legitimate projects, especially for time-constrained developers or automated systems.

The primary vector for malware delivery is through the repositories’ README files. These files, typically the first point of interaction for anyone exploring a GitHub project, are engineered to direct visitors to download ZIP archives. These archives are disguised as legitimate installers or project releases but, in reality, contain obfuscated Lua payloads. Upon execution, these payloads trigger the deployment of SmartLoader, a robust initial access loader.

Once SmartLoader gains a foothold, it establishes persistence on the compromised system, often through scheduled tasks, ensuring its survival across reboots. A critical component of its operation involves retrieving its command-and-control (C2) address, a crucial step for subsequent stages of the attack. Intriguingly, SmartLoader utilizes a Polygon smart contract for this C2 communication, a novel approach that leverages decentralized blockchain technology to enhance resilience and evade traditional detection mechanisms. Following C2 establishment, SmartLoader downloads additional encrypted stages directly from GitHub, culminating in the deployment of the StealC information stealer. StealC is known for its advanced capabilities in exfiltrating sensitive data, including credentials, financial information, and other personal data, posing a severe threat to both individual users and corporate networks.

The "AgentBaiting" Innovation: Weaponizing AI for Cybercrime

One of the most concerning aspects of the FakeGit campaign is the emergence of what Island researchers term "AgentBaiting." This innovative technique is specifically designed to capitalize on the increasing integration of AI agents and automated workflows into software development and enterprise operations. The core premise of AgentBaiting is to craft malicious repositories in such a way that they are more likely to be discovered, parsed, and subsequently recommended by AI agents to human operators.

In a typical AgentBaiting scenario, an AI agent, tasked with finding relevant code, tools, or solutions, would encounter these malicious repositories. Given their convincing documentation, keyword optimization (e.g., "AI skills," "MCP servers"), and presence in various public registries, the AI agent is likely to parse the README contents as legitimate project documentation. Consequently, the AI might recommend the repository or its associated ZIP file download to a human developer, effectively turning the AI itself into an unwitting accomplice in the malware distribution chain.

Island’s research highlighted the effectiveness of this technique through controlled testing. Leading AI models such as ChatGPT, Gemini, and Claude were prompted with related development tasks. In several instances, these AI agents surfaced various malicious repositories linked to the FakeGit campaign and, disturbingly, sometimes relayed the malicious installation instructions directly to the user. This demonstrates a critical vulnerability in how AI agents currently evaluate and recommend external resources, particularly in the absence of robust, context-aware security vetting.

The pervasive nature of AgentBaiting is further evidenced by the discovery of over 600 listings for skills and MCP (Modular Cloud Platform) servers in public registries and catalogs that were directly linked to the FakeGit campaign. Platforms like LobeHub, Glama, MCP.so, and MCP Market were found to contain these malicious entries. This indicates that the operation has already deeply penetrated the AI and developer ecosystems, effectively "poisoning" public resources that developers and AI agents rely upon for discovering tools and functionalities. While researchers could not definitively determine if these listings were submitted manually by the threat actors or automatically indexed by the platforms, their mere presence significantly boosts the discoverability and perceived credibility of the malicious repositories.

In a specific, limited, and controlled test, Island researchers observed Claude Code, an AI coding agent, cloning malicious repositories and downloading the malicious files onto a test machine. Crucially, however, the agent subsequently detected suspicious indicators and halted its process before actual execution of the malware. This incident, while not designed to establish a definitive detection rate, offers a glimmer of hope that some advanced AI agents might possess nascent capabilities to identify and mitigate threats during the execution stage. Nevertheless, it also underscores the critical need for continuous research and development into AI safety and security, ensuring that these powerful tools do not inadvertently become conduits for cyberattacks.

Scale of Impact and Broader Implications

The sheer scale of the FakeGit campaign is staggering. With 7,600 malicious GitHub repositories, the potential for widespread compromise is immense. Island’s analysis of GitHub’s public download counters revealed 14,084,688 cumulative download events for 335 unique Release assets across 211 of the GitFake repositories. Oleg Zaytsev, Lead Security Researcher at Island, clarified that this figure represents total requests, including repeated downloads and automated activity, and should not be directly interpreted as the number of unique infections. However, even as an indicator of exposure, it paints a grim picture of the campaign’s reach and the significant risk it poses to the developer community.

The implications of AgentBaiting extend beyond immediate malware infections. It fundamentally erodes trust in open-source resources and the recommendations provided by AI agents. As AI increasingly assists developers in writing, debugging, and discovering code, the integrity of the information fed to these AI systems becomes paramount. If AI agents are susceptible to recommending malicious content, it introduces a dangerous new layer of supply chain risk into software development. Organizations that are rapidly adopting AI-driven development practices must now contend with the possibility that their own AI tools could inadvertently introduce malware or vulnerabilities into their systems.

Moreover, the use of blockchain technology for C2 communication by SmartLoader signals a trend towards more resilient and evasive malware infrastructure. Traditional network security tools often struggle to effectively monitor and block traffic to decentralized networks, providing threat actors with a more robust and persistent means of controlling their malicious payloads.

Mitigation and Future Outlook

In light of the FakeGit campaign and the sophisticated AgentBaiting technique, cybersecurity experts and platform providers must enhance their defenses. For organizations, Island recommends several critical measures:

1. Maintain Approved Catalogs: Establish and maintain internal, vetted catalogs of approved AI skills, MCP servers, and open-source components. This reduces reliance on potentially compromised public registries.
2. Isolated Testing Environments: Implement stringent practices for testing any new capabilities or third-party code in isolated, sandboxed environments before integration into production systems.
3. Independent Verification: Always verify the publishers and repositories of any external tools or code independently, beyond superficial checks. Look for established track records, community reputation, and official endorsements.
4. Immediate Secret Rotation: In any suspected SmartLoader execution scenario, all secrets, credentials, and API keys on impacted environments should be rotated immediately to prevent further compromise and data exfiltration.

GitHub, as the primary platform exploited in this campaign, faces an ongoing challenge in policing its vast repository of user-generated content. While GitHub actively works to identify and remove malicious repositories, the sheer volume and the sophisticated cloaking techniques employed by threat actors make this a continuous cat-and-mouse game. Enhanced AI-driven detection mechanisms and more proactive community reporting will be crucial in mitigating such large-scale operations.

The FakeGit campaign serves as a stark reminder of the ever-evolving nature of cyber threats and the increasing sophistication of adversaries like "Water Kurita." The weaponization of AI-themed lures and the novel "AgentBaiting" technique represent a new frontier in cyber warfare, directly targeting the tools and workflows that define modern software development. As AI becomes more integral to our digital lives, the imperative to build secure AI systems and to educate users about the unique risks associated with AI-driven recommendations will only grow. The security community must remain vigilant, collaborative, and innovative to stay ahead of these emerging threats and safeguard the integrity of the global digital infrastructure.