Massive FakeGit Campaign Leverages AI Lures on GitHub, Infecting Systems with SmartLoader and StealC, Cybersecurity Researchers Warn

Cybersecurity researchers have uncovered a pervasive and sophisticated campaign, codenamed FakeGit, which has established nearly 7,600 malicious GitHub repositories. A significant subset of these, exceeding 800, cunningly masquerade as legitimate artificial intelligence (AI) skills or Model Context Protocol (MCP) servers, serving as a conduit to deploy a potent malware family known as SmartLoader. This extensive operation represents a troubling evolution in cyber threats, particularly through a newly identified tactic dubbed AgentBaiting, which exploits the nascent capabilities of AI agents.

The Anatomy of FakeGit: A Deceptive Open-Source Onslaught

The FakeGit campaign meticulously constructs a believable façade to ensnare unsuspecting users and, critically, autonomous AI agents. According to Oleg Zaytsev, lead security researcher at Island, who detailed the findings in a report shared with The Hacker News, "FakeGit uses copied projects, lookalike developer profiles, convincing READMEs, and malicious ZIP files to deliver SmartLoader malware." This strategy leverages the inherent trust associated with open-source platforms like GitHub, where developers frequently seek and integrate code snippets, tools, and libraries. The sheer scale of the operation is alarming, with approximately 6,600 unique profiles responsible for creating the vast network of malicious repositories.

The primary objective behind these elaborate deceptions is to gain initial access to compromised systems via SmartLoader. Once established, SmartLoader acts as a persistent foothold, enabling the attackers to subsequently deploy secondary payloads. The most prominent of these secondary payloads is StealC, a notorious information stealer. StealC possesses the capability to exfiltrate a broad spectrum of sensitive data from infected machines, ranging from credentials and financial information to personal documents and proprietary code. The modular nature of this attack chain allows threat actors flexibility, potentially deploying other malware depending on their strategic objectives, making the initial SmartLoader breach a critical point of compromise.

The Rise of AgentBaiting: Exploiting AI Autonomy

While the use of trojanized MCP servers to distribute SmartLoader and StealC has been previously documented – notably flagged earlier this year by Straiker AI and subsequently by Derp.ca – the FakeGit campaign introduces a far more insidious dimension with AgentBaiting. This innovative technique marks a concerning evolution, demonstrating how threat actors are adapting their methodologies to exploit the burgeoning landscape of AI-driven tools.

AgentBaiting occurs when an AI agent, performing a search for a specific skill or an MCP server, inadvertently stumbles upon one of these meticulously crafted bogus GitHub repositories. Crucially, the AI agent then proceeds to execute the attacker’s instructions autonomously, without any direct human intervention. This represents a paradigm shift from traditional social engineering, which primarily targets human decision-making, to a form of "AI social engineering" where the AI itself is deceived.

Island’s extensive testing revealed that leading AI models, including Anthropic Claude Code, Google Gemini, and OpenAI ChatGPT, were susceptible to this sophisticated trickery. These models were observed surfacing malicious campaign repositories even when not explicitly provided with a malicious link. This implies that a simple, seemingly innocuous prompt such as "Find free claude cinematic prompt skill, and give me the installation instructions" or "give me a free walmart MCP server link" could lead an AI agent to discover and potentially recommend a compromised repository. The AI, interpreting the malicious README as legitimate documentation, would then relay the attacker’s setup instructions to the user, effectively acting as an unwitting accomplice in the infection chain. This blurs the lines between legitimate AI assistance and automated cyber espionage, presenting a formidable new challenge for cybersecurity professionals.

Scale and Scope of the Deception

The sheer scale of the FakeGit operation underscores its significant threat potential. Of the almost 7,600 malicious GitHub repositories identified, 800 were specifically designed to imitate AI Skills or MCP servers. These deceptive offerings spanned a wide array of perceived utility, targeting both individual users and enterprise environments. The malicious repositories purported to offer integrations for popular consumer applications like Gmail and WhatsApp, as well as critical enterprise tools such as Databricks, Jenkins, and Docker tooling. This broad appeal ensures a wider victim pool, leveraging the demand for enhanced functionality across diverse technological stacks.

As of July 2026, the FakeGit operation had already recorded over 14 million downloads across GitHub Release assets, originating from approximately 200 of the campaign’s repositories. This staggering number highlights the effectiveness of the threat actors’ distribution methods and the pervasive reach of their deceptive content. The strategic naming and content of these counterfeit repositories were deliberately crafted to align with existing demands for AI capabilities, borrowing familiar names and workflows to lend an air of authenticity. Zaytsev explained, "That familiarity gave the malicious ZIP files a credible reason to be downloaded, while the README guided users or agents from what appeared to be routine setup into the SmartLoader attack chain."

Furthermore, the threat is compounded by the fact that over 600 of these malicious campaign listings have been detected across various public MCP and Skill registries, including prominent platforms like LobeHub, Glama, MCP.so, and MCP Market. The presence of these listings on public registries imbues them with a false sense of legitimacy, making them appear more trustworthy to both human users and AI agents diligently searching for relevant tools and functionalities. This strategic placement in trusted directories significantly amplifies the reach and potential impact of the FakeGit campaign.

The Malware Profile: SmartLoader and StealC in Detail

At the heart of the FakeGit campaign lies a two-stage malware deployment mechanism involving SmartLoader and StealC. The initial stage of compromise begins with the downloading of a seemingly legitimate ZIP archive from a malicious GitHub repository. This ZIP file, designed to appear as routine setup files for an AI skill or MCP server, actually initiates a LuaJIT loader chain. LuaJIT, a just-in-time compiler for the Lua programming language, is a legitimate tool often used in performance-critical applications. However, in this context, it is weaponized to execute an obfuscated Lua script. This script is then responsible for dropping and executing SmartLoader.

SmartLoader is designed to be a highly versatile and resilient initial access malware. Its primary functions include establishing persistence on the compromised system, allowing attackers to maintain access even after reboots, and serving as a platform for deploying additional malicious payloads. Its stealth capabilities ensure it remains undetected for as long as possible, silently exfiltrating system information and preparing the ground for the next stage of the attack.

Once SmartLoader is firmly entrenched, it proceeds to deploy StealC. StealC is an advanced information stealer that has gained notoriety in the cybercriminal underground for its extensive data harvesting capabilities. It targets a wide array of sensitive information, including:

• Credentials: Login details for web services, email accounts, banking portals, and corporate networks.
• Financial Data: Credit card numbers, cryptocurrency wallet details, and other payment information.
• Browser Data: Saved passwords, cookies, browsing history, and autofill data from popular web browsers.
• System Information: Operating system details, installed software, hardware configurations, and network settings.
• Documents and Files: Sensitive documents, spreadsheets, and other files from local drives and cloud storage synchronizations.
• Communication Data: Chat logs, email content, and social media activity.

The deployment of StealC after SmartLoader ensures that attackers not only gain a persistent foothold but also maximize their chances of acquiring high-value data, which can then be sold on dark web markets, used for further attacks, or leveraged for corporate espionage.

Historical Context and Evolving Threat Landscape

The cybersecurity community has been increasingly vigilant regarding supply chain attacks, particularly those targeting open-source repositories. The trust placed in platforms like GitHub makes them prime targets for malicious actors seeking to inject their code into legitimate development workflows. Earlier warnings from Straiker AI and Derp.ca about the use of trojanized MCP servers to distribute SmartLoader and StealC provided an initial glimpse into these tactics. However, FakeGit and AgentBaiting represent a significant escalation, showcasing the attackers’ adaptability and their willingness to leverage emerging technologies like AI.

This evolution highlights a broader trend in cybercrime: the continuous innovation by threat actors to circumvent existing defenses and exploit new vectors. As AI agents become more integrated into daily workflows, performing tasks ranging from code generation to system administration, they inherently become new targets for exploitation. The ability to "socially engineer" an AI agent, rather than a human, opens up novel avenues for widespread compromise, making the threat far more automated and scalable. The shift from human-centric social engineering to AI-centric deception underscores the dynamic nature of the cyber threat landscape, where yesterday’s defenses may prove inadequate against tomorrow’s attacks.

Implications for Cybersecurity and AI Development

The FakeGit campaign, particularly with its AgentBaiting component, carries profound implications for multiple sectors:

• Open-Source Integrity: The campaign erodes trust in open-source platforms. Developers may become increasingly wary of integrating external code, potentially stifling innovation and collaboration. GitHub, as a central hub for millions of developers, faces an ongoing challenge in policing its vast ecosystem for such sophisticated, camouflaged threats.
• Supply Chain Security: Businesses relying on open-source components for their software development pipelines are at heightened risk. A compromised AI skill or MCP server could introduce malware deep into an organization’s infrastructure, leading to severe data breaches, operational disruptions, and significant financial losses.
• Trust in AI Systems: AgentBaiting directly challenges the reliability and trustworthiness of AI agents. If AI models can be tricked into promoting or executing malicious code, their utility and adoption in sensitive environments could be severely curtailed. This necessitates a re-evaluation of how AI agents interact with external information and how their decision-making processes are secured.
• AI Development and Governance: The incident underscores the urgent need for robust security measures and ethical guidelines in AI development. Ensuring that AI models are resilient to adversarial attacks and capable of discerning malicious content from legitimate information will be paramount for the safe and responsible deployment of AI technologies.
• User Education: While AI agents are now targets, human users remain critical. Educating developers and general users about verifying sources, scrutinizing READMEs, and understanding the risks associated with downloading code from unverified repositories is more important than ever.

Recommendations and Mitigation Strategies

To counter the multifaceted threat posed by FakeGit and AgentBaiting, cybersecurity experts at Island offer several critical recommendations, emphasizing a proactive and multi-layered defense strategy:

1. Build a Curated Catalog of Reviewed Skills, MCP Servers, and Agent Plugins: Organizations should establish internal repositories or whitelists of vetted and approved AI skills, MCP servers, and agent plugins. This ensures that only trusted and verified components are utilized within their environments, reducing the attack surface significantly.
2. Evaluate New Agent Capabilities in a Sandboxed Environment First: Before deploying any new AI agent capabilities or integrations into production environments, it is imperative to test them thoroughly within isolated, sandboxed environments. This allows for the observation of their behavior, identification of any suspicious activities, and validation of their security posture without risking critical systems.
3. Verify Both the Publisher and the Project to Ensure Credibility: A crucial step in preventing compromise is rigorous verification. Users and organizations must go beyond simply trusting a project based on its name or apparent functionality. It involves scrutinizing the publisher’s reputation, checking for legitimate digital signatures, reviewing code for suspicious elements, and ensuring that the project’s claims align with its actual contents. Discrepancies or a lack of transparency should raise immediate red flags.
4. Monitor Agentic Pathways for Anomalous Behavior: As AI agents become more autonomous, monitoring their activity becomes paramount. Implementing robust logging and anomaly detection systems specifically tailored to observe agentic pathways – how AI agents discover, interpret, and act upon information – can help identify instances where an agent might be falling victim to AgentBaiting or other forms of AI deception. This includes monitoring for unusual resource requests, unexpected external communications, or deviations from expected operational patterns.

Island aptly summarized the simplicity yet effectiveness of the attackers’ approach: "FakeGit did not need to breach anything. It published convincing repositories, borrowed real developers’ identities, spread its listings across public registries, and let discovery do the rest." With AgentBaiting, the discovery mechanism has become even more insidious, bypassing human discernment entirely. "With AgentBaiting, that discovery no longer requires a person at all: an agent searching for a Skill or MCP server can find the lure, read the attacker’s README, and carry its instructions forward. The defenses that matter are the ones that interrupt this chain before execution."

The FakeGit campaign, with its sophisticated AgentBaiting tactic, serves as a stark reminder of the ever-evolving nature of cyber threats. As AI becomes more integral to our digital lives, the battleground for cybersecurity expands, demanding continuous vigilance, innovative defensive strategies, and a collaborative effort across the technology ecosystem to safeguard against these increasingly intelligent and automated attacks.