Cybersecurity researchers have uncovered a vast and evolving malicious campaign, dubbed FakeGit, which has leveraged nearly 7,600 illicit GitHub repositories to distribute the SmartLoader malware family. A particularly alarming development within this campaign, known as AgentBaiting, sees threat actors weaponizing artificial intelligence (AI) agents to inadvertently discover and propagate these malicious payloads, bypassing direct human intervention. This sophisticated operation marks a significant escalation in software supply chain attacks, demonstrating a novel method for delivering malware and establishing persistent access to compromised systems.
The FakeGit Campaign: A Deep Dive into Digital Deception
The FakeGit operation, meticulously documented by Oleg Zaytsev, lead security researcher at Island, has established a sprawling infrastructure designed to ensnare unsuspecting developers and, more recently, autonomous AI agents. At its core, FakeGit employs deceptive tactics including the creation of copied projects, meticulously crafted lookalike developer profiles, convincing README files, and the distribution of malicious ZIP archives. These elements collectively serve to deliver SmartLoader malware, a versatile initial access broker. Out of the thousands of identified malicious repositories, more than 800 specifically masquerade as legitimate AI skills or Model Context Protocol (MCP) servers, capitalizing on the burgeoning interest and reliance on AI-driven tools and integrations.
GitHub, as the world’s largest platform for software development and version control, serves as a critical hub for open-source projects and collaborative coding. Its immense repository of code, tools, and developer resources makes it an attractive target for threat actors seeking to inject malicious code into the software supply chain. The sheer volume of repositories and user activity on GitHub provides a fertile ground for blending in malicious projects with legitimate ones, making detection challenging for both automated systems and human users. The FakeGit campaign exploits this environment by mirroring popular projects and services, creating a convincing façade of legitimacy that developers often rely on when seeking new tools or integrations.
Understanding the Malware Payload: SmartLoader and StealC
The primary objective behind the FakeGit campaign is to establish a foothold on compromised systems using SmartLoader. This initial payload acts as a highly adaptable loader, designed to execute further malicious code and ensure persistence. Once SmartLoader has successfully infiltrated a system, it is leveraged to deploy secondary payloads, most notably StealC.
StealC is a potent information stealer, a class of malware specifically designed to exfiltrate a wide array of sensitive data from compromised machines. Its capabilities typically include harvesting credentials (usernames, passwords, tokens), browser history, cookies, cryptocurrency wallet information, system configuration details, and various other files. The data collected by StealC can then be used for a multitude of nefarious purposes, ranging from financial fraud and identity theft to corporate espionage and further network intrusion. The modular nature of SmartLoader allows the attackers significant flexibility, enabling them to adapt their post-compromise activities based on the target and their evolving objectives, making it a formidable threat in the cybercriminal toolkit.
The Emergence of AgentBaiting: AI-Driven Compromises
A concerning evolution within the FakeGit campaign is what researchers have termed AgentBaiting. This novel technique represents a significant leap in attack sophistication, where AI agents themselves become vectors for malware delivery. Traditionally, social engineering attacks rely on deceiving human users into clicking malicious links or downloading compromised files. AgentBaiting, however, manipulates the autonomous search and discovery functions of AI agents.
In an AgentBaiting scenario, an AI agent, tasked with searching for a specific "skill" or an MCP server to augment its capabilities, inadvertently discovers one of these bogus GitHub repositories. These repositories are meticulously designed to appear relevant to AI agents’ search queries. Upon discovery, the AI agent, processing the convincing (but malicious) README files as legitimate documentation, proceeds to execute the attacker’s instructions. This means the AI agent, without any direct intervention or suspicious action from a human user, effectively "does the attacker’s bidding" by leading itself or its user down the malicious attack chain.
Island’s tests confirmed the susceptibility of leading AI models, including Anthropic Claude Code, Google Gemini, and OpenAI ChatGPT, to this trickery. These models were observed to surface malicious campaign repositories in response to general prompts, even without being explicitly provided a malicious link. This groundbreaking method demonstrates how a social engineering technique originally crafted to deceive humans has been refined to equally deceive advanced AI agents operating on their behalf, introducing an entirely new dimension to cyber threats.
Historical Context and Previous Warnings
The use of trojanized MCP servers for distributing SmartLoader and StealC is not entirely new. Earlier this year, cybersecurity firms Straiker AI and Derp.ca independently flagged similar activities. Straiker AI initially highlighted the deployment of SmartLoader via trojanized Oura AI components, while Derp.ca’s research further detailed a campaign involving FakeGit and LuaJIT on GitHub. These earlier observations served as precursors to the more expansive and AI-aware FakeGit operation now being detailed.
The current campaign, however, distinguishes itself through its sheer scale and the integration of AgentBaiting. The progression from human-targeted social engineering to AI-targeted deception underscores a rapid adaptation by threat actors to the evolving technological landscape. The July 2026 data indicating over 14 million downloads across GitHub Release assets in approximately 200 campaign repositories points to the significant success and reach of this persistent threat. This chronology illustrates a clear and escalating pattern of cybercriminal innovation, moving from opportunistic attacks to more targeted and automated methodologies.
Scale and Reach of the Operation
The FakeGit operation exhibits an alarming scale, with researchers identifying approximately 7,600 malicious GitHub repositories originating from around 6,600 distinct profiles. A significant portion of these, specifically 800 repositories, were designed to mimic legitimate AI Skills or MCP servers. These counterfeit offerings spanned a wide range of integrations, targeting both individual and enterprise users. Examples included bogus integrations for popular consumer applications like Gmail and WhatsApp, as well as critical enterprise tools such as Databricks, Jenkins, and Docker. This broad targeting strategy aims to maximize the potential victim pool, exploiting the demand for tools that enhance productivity and automation across various platforms.
The high volume of downloads—over 14 million by July 2026—underscores the efficacy of the attackers’ deception. These downloads indicate that a substantial number of users, and potentially AI agents, have interacted with and likely executed the malicious payloads. Furthermore, the discovery of over 600 campaign listings across various public MCP and Skill registries, including LobeHub, Glama, MCP.so, and MCP Market, grants these malicious projects a false sense of legitimacy. The presence on these reputable platforms makes them more discoverable and trustworthy in the eyes of both human users and AI agents performing automated searches, significantly amplifying the threat.
Mechanism of Deception: A Credible Lure
The success of FakeGit hinges on its sophisticated mechanism of deception. Attackers meticulously craft counterfeit repositories, which are either entirely fabricated or cleverly copied from existing legitimate projects. This replication includes not just the code structure but also the branding, documentation, and even developer identities, creating a highly convincing facade. The core of the attack chain is initiated when a user or an AI agent downloads a seemingly innocuous ZIP archive from one of these repositories.
Upon execution, this ZIP archive triggers a LuaJIT loader chain. LuaJIT is a Just-In-Time compiler for the Lua programming language, often used for performance-critical applications. In this context, it is exploited to execute an obfuscated Lua script. This script is responsible for dropping the SmartLoader malware onto the compromised system. Following the successful deployment of SmartLoader, the loader proceeds to deploy StealC, ensuring that the attackers gain persistent access and the ability to exfiltrate sensitive data. Oleg Zaytsev elaborates, "The repositories were designed to meet demand already forming around AI capabilities, borrowing the names and workflows of familiar consumer and enterprise tools. That familiarity gave the malicious ZIP files a credible reason to be downloaded, while the README guided users or agents from what appeared to be routine setup into the SmartLoader attack chain." This strategy highlights the psychological engineering employed, exploiting users’ trust in familiar names and the perceived utility of AI enhancements.
Implications for Software Supply Chain and AI Trust
The FakeGit campaign, particularly with its AgentBaiting component, carries profound implications for software supply chain security and the burgeoning trust placed in AI systems. The ability of attackers to inject malicious code into widely used platforms like GitHub and then propagate it through both human interaction and autonomous AI agent discovery represents a significant escalation in cyber threats. It fundamentally challenges the integrity of open-source ecosystems and the security assumptions underlying AI-driven workflows.
For the software supply chain, this campaign underscores the vulnerability inherent in relying on external dependencies and public repositories. Developers often integrate third-party libraries, tools, and components into their projects, inadvertently inheriting any security risks associated with those external elements. When malicious actors can so effectively mimic legitimate projects, the entire chain of trust is compromised, potentially leading to widespread infections across numerous applications and systems that consume these "skills" or "servers."
The advent of AgentBaiting also erodes trust in AI agents. If AI models designed to assist users can be tricked into facilitating malware delivery, it raises serious questions about their security posture and the prudence of granting them extensive autonomy. As AI agents become more prevalent in daily tasks, from code generation to data analysis and system management, ensuring their resilience against such sophisticated deception becomes paramount. The incident highlights a critical new attack surface where AI models, without direct human input, can inadvertently become instruments for malicious actors, transforming routine AI-assisted discovery operations into pathways for executing harmful code.
Official Responses and Industry Vigilance
While specific official statements from GitHub or the developers of the directly impacted AI models (Anthropic, Google, OpenAI) were not immediately available in the context of this specific report, such widespread malicious activity typically prompts swift and decisive action from platform providers. GitHub, for instance, maintains robust policies against malware distribution and copyright infringement, and it is highly probable that they are actively working to identify and remove the offending repositories and developer profiles associated with FakeGit. Their ongoing efforts often include automated scanning for suspicious code and user-reported takedowns.
Similarly, AI model developers are likely to be closely monitoring these developments. The susceptibility of their models to AgentBaiting necessitates a re-evaluation of their security frameworks, particularly concerning how their AI agents interact with external data sources and interpret documentation. Enhancements to prompt engineering defenses, improved content validation mechanisms, and stricter vetting of external "skills" or "plugins" are crucial steps for these companies to mitigate future risks. The cybersecurity industry as a whole is likely to increase its focus on AI security, developing new tools and methodologies to detect and counteract AI-driven deception tactics.
Mitigating the Threat: Recommendations for Users and Enterprises
Given the sophistication and evolving nature of the FakeGit campaign, robust mitigation strategies are essential for both individual developers and large enterprises. Island researchers provide several key recommendations to counter this emerging threat:
- Build a Catalog of Reviewed Skills, MCP Servers, and Agent Plugins: Organizations should establish and maintain an internal, curated catalog of approved AI skills, MCP servers, and agent plugins. This involves thorough vetting and verification of each component before it is integrated into operational workflows. Relying solely on public registries or ad-hoc discovery carries inherent risks.
- Evaluate New Agent Capabilities in a Sandboxed Environment: Before rolling out new AI agent capabilities or integrating new external skills across an enterprise, it is critical to test them within an isolated, sandboxed environment. This allows for observation of their behavior, network interactions, and potential vulnerabilities without risking production systems.
- Verify Both the Publisher and the Project to Ensure Credibility: A fundamental security practice is to rigorously verify the legitimacy of both the publisher (developer profile) and the project itself. This goes beyond a cursory glance at the README. Developers should check for signs of authenticity, such as a long-standing reputation, official affiliations, consistent coding practices, and a community of trusted contributors. Be wary of newly created profiles or projects with minimal history.
- Monitor Agentic Pathways: Enterprises utilizing AI agents should implement continuous monitoring of the pathways these agents use for discovery and interaction with external resources. This includes logging agent queries, responses, discovered resources, and any subsequent actions taken. Anomalous behavior or interactions with suspicious repositories should trigger immediate alerts and investigations.
- Educate Users on Supply Chain Risks: Continuous education for developers and end-users about the risks associated with software supply chain attacks and the importance of verifying open-source components is vital. Awareness campaigns can help foster a culture of security vigilance.
"FakeGit did not need to breach anything. It published convincing repositories, borrowed real developers’ identities, spread its listings across public registries, and let discovery do the rest," Island emphasized in its report. "With AgentBaiting, that discovery no longer requires a person at all: an agent searching for a Skill or MCP server can find the lure, read the attacker’s README, and carry its instructions forward. The defenses that matter are the ones that interrupt this chain before execution." This highlights the shift from active breaching to passive luring, making detection and prevention even more challenging.
The Evolving Cyber Threat Landscape
The FakeGit and AgentBaiting campaigns serve as a stark reminder of the rapidly evolving cyber threat landscape. As AI technologies become increasingly integrated into everyday computing and development processes, threat actors will inevitably seek to exploit their capabilities and vulnerabilities. The transition from human-centric social engineering to AI-centric deception marks a significant turning point, demanding innovative and proactive cybersecurity strategies. The battle against malware is no longer just about protecting endpoints and networks from direct attacks but also about securing the intelligent agents that interact with and interpret our digital world. The future of cybersecurity will increasingly involve understanding and defending against threats that leverage AI’s own mechanisms for nefarious purposes, making vigilance, robust verification, and continuous adaptation more critical than ever before.
