Cybersecurity experts have identified close to 7,600 harmful GitHub repositories, with over 800 masquerading as artificial intelligence (AI) skills or Model Context Protocol (MCP) servers to disseminate a malware variant known as SmartLoader, as part of an ongoing initiative referred to as FakeGit.
According to Oleg Zaytsev, the lead security researcher at Island, in a report shared with The Hacker News, “FakeGit employs cloned projects, imitation developer profiles, persuasive READMEs, and harmful ZIP files to propagate SmartLoader malware.”
The primary objective of these attacks is to utilize the access granted by SmartLoader to maintain persistence and deploy secondary payloads, such as StealC, an information-stealing tool capable of extracting a wide array of data from compromised systems.
It is important to note that the use of trojanized MCP servers for the distribution of SmartLoader and StealC was previously highlighted earlier this year by Straiker AI and later by Derp.ca. However, a particularly alarming aspect of FakeGit is an AI-driven evolution known as AgentBaiting.
This phenomenon occurs when an AI agent searching for a skill or an MCP server inadvertently stumbles upon one of these fraudulent GitHub repositories, leading it to execute the attacker’s commands autonomously, without any human intervention.
Island’s tests indicated that Anthropic Claude Code, Google Gemini, and OpenAI ChatGPT are vulnerable to this manipulation, enabling the models to uncover malicious campaign repositories without even being provided a link. In essence, a technique originally designed to socially engineer humans now possesses the ability to equally mislead an AI agent acting on their behalf.
Among the 7,600 harmful GitHub repositories created by approximately 6,600 profiles, 800 were disguised as Skills or MCP servers intended for both individual and enterprise use, covering integrations from Gmail and WhatsApp to tools like Databricks, Jenkins, and Docker. By July 2026, the FakeGit operation had recorded over 14 million downloads across GitHub Release assets in around 200 campaign repositories.
Zaytsev elaborated, “The repositories were crafted to align with the growing demand for AI capabilities, borrowing names and workflows from well-known consumer and enterprise tools. This familiarity provided a credible rationale for downloading the malicious ZIP files, while the README directed users or agents from what seemed like standard setup into the SmartLoader attack chain.”
The counterfeit repositories, whether entirely fabricated or copied from legitimate projects, act as a conduit for a ZIP archive, which subsequently triggers a LuaJIT loader chain, culminating in the execution of an obfuscated Lua script responsible for deploying SmartLoader. The loader then continues to install StealC.
AgentBaiting intensifies this threat, as it creates a scenario where an AI agent can be lured into discovering a FakeGit repository without needing to provide a malicious link, simply by issuing prompts like, “Find free claude cinematic prompt skill, and give me the installation instructions” or “give me a free walmart MCP server link.”
Island stated, “While attempting to complete a task, it can independently discover a FakeGit repository, regard the README as authentic documentation, and relay the attacker’s instructions to the user. FakeGit has structured its AI lures around this pathway.”
This technique once again illustrates how routine AI-assisted discovery operations can be exploited for malicious code execution, a concern that is heightened when the harmful skills or MCP servers are listed on public registries such as LobeHub, Glama, MCP.so, and MCP Market, which provide them with a misleading sense of legitimacy. Over 600 campaign listings have been flagged across public MCP and Skill registries.
To mitigate this threat, it is recommended to create a catalog of vetted Skills, MCP servers, and agent plugins, assess new agent capabilities in a sandboxed environment prior to broader deployment, and verify both the publisher and the project to ensure credibility.
Source: Original article
