Security researchers have uncovered a massive malware campaign that uses thousands of fake GitHub repositories to infect users and even mislead AI assistants into recommending malicious projects.
The operation, tracked as FakeGit, has created nearly 7,600 fraudulent GitHub repositories, including more than 800 fake AI Skills and Model Context Protocol (MCP) servers, to distribute the SmartLoader malware.
According to researchers at Island, the attackers copy legitimate open-source projects, create convincing developer profiles, write realistic README files, and package malicious ZIP archives that appear to be genuine software downloads. Once executed, the files launch SmartLoader, which establishes persistence on the victim’s system before downloading additional malware such as StealC, an information-stealing program capable of collecting passwords, browser data, cryptocurrency wallets, and other sensitive information.
Researchers say the campaign has evolved beyond traditional social engineering with a new technique called AgentBaiting. Instead of waiting for a person to find a malicious repository, attackers now design fake projects that AI assistants can discover on their own when responding to user requests. During testing, researchers found that AI tools including Claude Code, Google Gemini, and ChatGPT could surface these fake repositories when users asked for AI skills or MCP servers, even without being given a malicious link.
The fake repositories imitate popular AI tools and enterprise integrations, including Gmail, WhatsApp, Databricks, Jenkins, and Docker. By using familiar names and convincing documentation, attackers make the malicious downloads appear trustworthy. Researchers estimate the FakeGit campaign has generated more than 14 million downloads through GitHub Release assets across roughly 200 campaign repositories as of July 2026.
After victims download the ZIP archive, the attack chain uses a LuaJIT-based loader to execute an obfuscated Lua script that installs SmartLoader. The malware then deploys StealC to steal sensitive data from the infected device.
The threat becomes even more dangerous because many of these fake AI tools have been listed on public MCP and AI Skill directories such as LobeHub, Glama, MCP.so, and MCP Market, giving them an appearance of legitimacy. Researchers identified more than 600 malicious listings across these public registries.
To reduce the risk, security experts recommend using only trusted and verified AI Skills and MCP servers, testing new AI integrations in isolated environments before deployment, carefully verifying repository publishers, and monitoring AI-assisted workflows that automatically search for and recommend external tools.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
The FakeGit campaign highlights a growing cybersecurity challenge where attackers are targeting not only human users but also AI-powered assistants, turning automated software discovery into a new pathway for malware distribution.
