Cybersecurity researchers have found practically 7,600 malicious GitHub repositories, out of which greater than 800 pose as synthetic intelligence (AI) expertise or Mannequin Context Protocol (MCP) servers to ship a malware household often called SmartLoader as a part of an ongoing marketing campaign codenamed FakeGit.
“FakeGit makes use of copied initiatives, lookalike developer profiles, convincing READMEs, and malicious ZIP information to ship SmartLoader malware,” Oleg Zaytsev, lead safety researcher at Island, stated in a report shared with The Hacker Information.
The tip purpose of those assaults is to leverage the entry afforded by SmartLoader to determine persistence and push secondary payloads, corresponding to StealC, an info stealer able to harvesting a variety of information from compromised techniques.
It is price mentioning right here that the usage of trojanized MCP servers to distribute SmartLoader and StealC was flagged earlier this yr by Straiker AI and subsequently by Derp.ca. However a regarding facet of FakeGit is an AI-powered evolution dubbed AgentBaiting.
This happens when an AI agent trying to find a ability or an MCP server finally ends up inadvertently discovering one in every of these bogus GitHub repositories, inflicting it to do the attacker’s bidding by itself with none intervention from a human consumer.
Island stated its assessments revealed Anthropic Claude Code, Google Gemini, and OpenAI ChatGPT to be prone to this trickery, permitting the fashions to floor malicious marketing campaign repositories with out even being proven a hyperlink. In different phrases, a way arrange with an authentic intent to socially engineer people now has the aptitude to equally deceive an AI agent performing on their behalf.
Of the 7,600 malicious GitHub repositories created by about 6,600 profiles, 800 posed as Expertise or MCP servers for particular person and enterprise use, from Gmail and WhatsApp integrations to Databricks, Jenkins, and Docker tooling. As of July 2026, the FakeGit operation has recorded greater than 14 million downloads throughout GitHub Launch belongings in about 200 marketing campaign repositories.
“The repositories have been designed to satisfy demand already forming round AI capabilities, borrowing the names and workflows of acquainted client and enterprise instruments,” Zaytsev defined. “That familiarity gave the malicious ZIP information a reputable purpose to be downloaded, whereas the README guided customers or brokers from what seemed to be routine setup into the SmartLoader assault chain.”
The counterfeit repositories, both utterly fabricated or copied from reputable initiatives, function a conduit for a ZIP archive, which is then used to set off a LuaJIT loader chain, resulting in the execution of an obfuscated Lua script accountable for dropping SmartLoader. Then the loader proceeds to deploy StealC.
AgentBaiting escalates this risk additional, because it opens the door to a situation the place an AI agent may be baited to find a FakeGit repository with out having to provide a malicious hyperlink by offering a immediate like this: “Discover free claude cinematic immediate ability, and provides me the set up directions” or “give me a free walmart MCP server hyperlink.”
“Whereas attempting to finish a activity, it might probably uncover a FakeGit repository by itself, deal with the README as reputable documentation, and go the attacker’s directions to the consumer,” Island stated. “FakeGit constructed its AI lures round this path.”
The approach as soon as once more demonstrates how routine AI-assisted discovery operations may be was an alley for malicious code execution, an issue that will get exacerbated when the malicious expertise or MCP servers are listed on public registries like LobeHub, Glama, MCP.so, and MCP Market, giving them a false sense of legitimacy. Greater than 600 marketing campaign listings have been flagged throughout public MCP and Ability registries.
To counter the risk, it is suggested to construct a catalog of reviewed Expertise, MCP servers, and agent plugins, consider new agent capabilities in a sandboxed surroundings first earlier than broader rollout, confirm each the writer and the undertaking to make sure credibility, and monitor agentic pathways.
“FakeGit didn’t must breach something. It revealed convincing repositories, borrowed actual builders’ identities, unfold its listings throughout public registries, and let discovery do the remaining,” Island stated.
“With AgentBaiting, that discovery now not requires an individual in any respect: an agent trying to find a Ability or MCP server can discover the lure, learn the attacker’s README, and carry its directions ahead. The defenses that matter are those that interrupt this chain earlier than execution.”
