FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware
Cybersecurity researchers have discovered nearly 7,600 malicious GitHub repositories, of which more than 800 appear to be artificial intelligence (AI) or Model Context Protocol (MCP) servers to deliver a malware family known as SmartLoader as part of an ongoing code-named campaign. FakeGit.
“FakeGit uses copied projects, fake developer profiles, convincing READMEs, and malicious ZIP files to deliver the SmartLoader malware,” said Oleg Zaytsev, lead security researcher at Island, in a report shared with Hacker News.
The ultimate goal of this attack is to use the access provided by SmartLoader to detect persistence and compress secondary payloads, such as StealC, a hacker capable of collecting various data from compromised systems.
It is worth mentioning here that the use of trojan-hosted MCP servers to distribute SmartLoader and StealC was flagged earlier this year by Straiker AI and later by Derp.ca. But what FakeGit is all about is the emergence of a powerful AI called AgentBaiting.
This happens when an AI agent searching for a skill or an MCP server accidentally finds one of these fake GitHub sites, allowing it to do what the attacker wants on its own without any intervention from a human user.
Island said its testing revealed Anthropic Claude Code, Google Gemini, and OpenAI ChatGPT to be vulnerable to this tactic, which allows models to reveal malicious campaign clusters without being shown a link. In other words, a method that was purposely developed by human social engineers now has the ability to manipulate an AI agent that does it for them.
Of the 7,600 malicious GitHub repositories created about 6,600 profiles, 800 are positioned as Skills or MCP servers for individual and business use, from Gmail and WhatsApp integrations to Databricks, Jenkins, and Docker tools. As of July 2026, the FakeGit operation has recorded more than 14 million downloads across all GitHub release assets in about 200 campaign repositories.
“Repositories are designed to meet the demand already made in terms of AI capabilities, borrowing terms and workflows for common consumer and business tools,” Zaytsev explained. “That commonality gave the malicious ZIP files a good reason to be downloaded, while the README directed users or agents to what appeared to be a common setup in the SmartLoader attack chain.”
Fake repositories, created entirely or copied from official projects, act as a ZIP archive conduit, which is then used to trigger the LuaJIT loading chain, leading to the execution of a mysterious Lua script responsible for crashing SmartLoader. After that the loader continues to feed StealC.
AgentBaiting increases this threat further, as it opens the door to a situation where an AI agent can be bribed to find a FakeGit repository without providing a malicious link by providing information such as: “Get the free cloud cinematic notification feature, and give me installation instructions” or “give me a free Walmart MCP link.”
“While trying to complete a task, it can find the FakeGit repository on its own, treat the README as official documentation, and relay the attacker’s instructions to the user,” Island said. “FakeGit built its AI threads on this method.”
This process also shows how AI-assisted discovery activities can be turned into a conduit for malicious code execution, a problem that is exacerbated when malicious capabilities or MCP servers are listed on public registries such as LobeHub, Glama, MCP.so, and MCP Market, giving them a false sense of legitimacy. Over 600 campaign listings have been tagged across the public MCP and Skills registry.
To combat the threat, it is advised to create a catalog of updated Skills, MCP servers, and agent plugins, test new agent skills in a sandboxed environment first before wide release, verify both publisher and project to ensure reliability, and monitor agent methods.
“FakeGit didn’t need to break anything. It published verifiable repositories, borrowed the credentials of real developers, distributed its list to all public registries, and allowed discovery to do the rest,” Island said.
“With AgentBaiting, that detection no longer requires a human: an agent looking for a Skill or MCP server can find the bait, read the attacker’s README, and carry out its instructions. The key defenses are those that interrupt this chain before execution.”
