FakeGit AgentBaiting: 7,600 GitHub Repos Push SmartLoader Malware

FakeGit, a large malicious GitHub repository operation, has moved into the AI capability supply chain with fake AI Skills and Model Context Protocol (MCP) server projects that deliver SmartLoader malware and then StealC infostealer. Island Security Research reported on July 20 that it found about 7,600 malicious GitHub repositories, including more than 800 posing as AI Skills or MCP servers and more than 600 listings across public AI capability registries.¹

The campaign matters because it does not rely only on a person clicking a random link. Island calls the newer pattern AgentBaiting: an AI assistant or coding agent can discover a malicious repository while looking for a Skill, plugin, connector, or MCP server, read the attacker-written README, and pass installation steps back to the user as if they came from a legitimate project.¹ The Hacker News amplified the findings on July 20, noting that the operation used copied projects, lookalike developer profiles, convincing READMEs, and malicious ZIP files to reach developers and AI-assisted workflows.²

What developers and AI-agent teams should check now

Island says the broader FakeGit operation involved about 6,600 GitHub profiles and more than 14 million measured downloads across GitHub Release assets in roughly 200 campaign repositories. The AI-themed branch included repositories framed around enterprise work such as Databricks, Jenkins, Docker, Gmail, WhatsApp, and cloud/API connectors. That positioning is important: these are the same categories teams might allow near source code, CI systems, cloud credentials, browser sessions, or production data.

The attack chain is intentionally mundane. A fake repository looks useful, its README points to a ZIP release, and the ZIP contains a small Windows launcher, a LuaJIT-style runtime, and an obfuscated Lua payload disguised as a harmless text or data file. Once executed, SmartLoader can establish persistence and retrieve later stages. Island and The Hacker News both describe StealC as the follow-on infostealer, with risk to browser passwords, cookies, active sessions, extension data, email credentials, remote-access credentials, screenshots, and host details.¹²

For HowToFix readers, the practical rule is simple: a Skill or MCP server should not arrive as a random Windows ZIP that asks to run an executable. Treat that as a stop sign, especially when the tool claims to connect to cloud services, developer infrastructure, email, databases, or CI/CD. The same caution applies to cloned GitHub repositories, fake proof-of-concept projects, and poisoned developer packages; recent campaigns against npm packages that dropped infostealers, fake GitHub PoC exploits, and AI service exposure show how quickly developer trust can become the delivery path.

Security teams should build a reviewed internal catalog for approved Skills, MCP servers, agent plugins, and browser/coding-assistant extensions. New capabilities should be tested first in a disposable environment with no production browser sessions, SSH keys, cloud tokens, OAuth grants, CI secrets, or customer data. Verify the publisher identity, repository history, release contents, and package hash before installation; a public registry listing or modest GitHub star count is not proof that the project is safe.

If a FakeGit-style package may have run, isolate the workstation and assume session theft, not just password theft. Revoke browser sessions, OAuth grants, API keys, cloud credentials, package-registry tokens, Git credentials, and any secrets available to the affected user or agent workspace. Then check scheduled tasks, recent downloads, GitHub Release ZIPs, Skill/MCP configuration directories, and agent-initiated shell history for repositories or hashes matching Island’s listed indicators.

References

1. Oleg Zaytsev, Island Security Research, “AgentBaiting: How 800+ Fake AI Skills and MCP Servers Delivered Malware,” July 20, 2026. https://www.island.io/blog/agentbaiting-how-800-fake-ai-skills-and-mcp-servers-delivered-malware
2. Swati Khandelwal, The Hacker News, “FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware,” July 20, 2026. https://thehackernews.com/2026/07/fakegit-campaign-uses-7600-github.html