FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware
A sophisticated campaign dubbed FakeGit has leveraged nearly 7,600 malicious GitHub repositories to spread SmartLoader malware, utilizing AI agents to discover these fake repositories and execute the attack. The campaign mimics legitimate AI skills and MCP servers, tricking AI models into downloading and executing malicious ZIP files, leading to the deployment of StealC, an information stealer. The attackers are exploiting AI's natural discovery processes to bypass traditional security measures.
Cybersecurity researchers have uncovered a widespread campaign, FakeGit, utilizing nearly 7,600 malicious GitHub repositories to distribute SmartLoader malware. The campaign employs a tactic known as AgentBaiting, where AI agents are tricked into discovering these fake repositories without needing a malicious link. The repositories are designed to mimic legitimate AI skills and MCP (Model Context Protocol) servers, offering integrations like Gmail and WhatsApp, and are presented with convincing READMEs and legitimate developer profiles.
“FakeGit uses copied projects, lookalike developer profiles, convincing READMEs, and malicious ZIP files to deliver SmartLoader malware,” Oleg Zaytsev, lead security researcher at Island, explained. The campaign has already resulted in over 14 million downloads across GitHub Release assets in approximately 200 campaign repositories.
AgentBaiting is a key component of the attack, where AI agents, searching for a specific skill or MCP server, can inadvertently discover these bogus repositories. For example, an agent prompted to find a “free claude cinematic prompt skill” might be directed to a FakeGit repository and instructed to follow the attacker’s instructions. The repositories are either completely fabricated or copied from legitimate projects, serving as a conduit for a ZIP archive that triggers a LuaJIT loader chain, leading to the execution of an obfuscated Lua script responsible for dropping SmartLoader and then StealC.
More than 600 campaign listings have been flagged across public MCP and Skill registries, including LobeHub, Glama, MCP.so, and MCP Market. The attackers are exploiting AI’s natural discovery operations to bypass traditional security measures, requiring no human interaction to initiate the attack.
To mitigate this threat, Island recommends building a catalog of reviewed Skills, MCP servers, and agent plugins, evaluating new agent capabilities in a sandboxed environment, verifying both the publisher and the project to ensure credibility, and monitoring agentic pathways. The FakeGit campaign demonstrates how AI-assisted discovery operations can be weaponized to deliver malware without requiring a direct breach.