FakeGit Campaign Leverages 7,600 Malicious GitHub Repositories and AI AgentBaiting to Distribute SmartLoader Malware

The global cybersecurity landscape is currently grappling with a sophisticated and expansive operation known as FakeGit, which has successfully weaponized the growing demand for artificial intelligence capabilities to distribute high-impact malware. Cybersecurity researchers have identified nearly 7,600 malicious GitHub repositories linked to this campaign, with a significant subset of over 800 repositories specifically designed to mimic AI "skills" and Model Context Protocol (MCP) servers. This operation marks a pivotal shift in cyber-adversary tactics, moving beyond the traditional social engineering of human users to a new frontier dubbed AgentBaiting, where autonomous AI agents are deceived into executing malicious instructions.

As of July 2026, the FakeGit operation has demonstrated remarkable reach, recording more than 14 million downloads across various GitHub Release assets. The campaign utilizes a sophisticated infrastructure of approximately 6,600 developer profiles to host repositories that appear legitimate, often copying the branding and documentation of popular enterprise tools. The primary objective of these attacks is the delivery of SmartLoader, a malicious loader that facilitates the subsequent deployment of StealC, a notorious information stealer capable of harvesting sensitive data from compromised systems.

The Mechanics of the FakeGit Operation

The FakeGit campaign is characterized by its meticulous attention to detail in creating a facade of legitimacy. According to Oleg Zaytsev, lead security researcher at Island, the threat actors behind FakeGit employ a multi-layered approach to deception. This includes the use of copied projects, lookalike developer profiles, and highly convincing README files that guide users through what appears to be a standard installation process.

The repositories are strategically named to capitalize on the current industry trend toward AI-driven automation. Many of the 800 AI-focused repositories pose as integrations for ubiquitous platforms such as Gmail, WhatsApp, Databricks, Jenkins, and Docker. By borrowing the names and workflows of familiar tools, the attackers create a sense of trust that bypasses the typical scrutiny applied to third-party code.

Once a user or an AI agent interacts with one of these repositories, they are often directed to download a ZIP archive containing the necessary "assets" for the tool. This archive serves as the initial infection vector. The attack chain typically involves a LuaJIT loader, which executes an obfuscated Lua script. This script is responsible for dropping SmartLoader into the system, which then establishes persistence and prepares the environment for the final payload, StealC.

Understanding the Payload: SmartLoader and StealC

The dual-threat combination of SmartLoader and StealC represents a significant risk to both individual users and enterprise environments. SmartLoader is designed for stealth and persistence, acting as a gateway for more specialized malware. Its primary role in the FakeGit campaign is to ensure that the initial breach remains undetected while it pulls down secondary payloads.

StealC, the final payload in this specific chain, is a modern information-stealing malware that has gained popularity in the cybercriminal underground due to its efficiency and wide range of capabilities. Once executed on a compromised system, StealC can perform the following actions:

• Browser Data Extraction: Harvesting saved passwords, cookies, credit card information, and autofill data from popular web browsers.
• Cryptocurrency Theft: Scanning for and exfiltrating private keys and seed phrases from digital wallets.
• System Reconnaissance: Collecting detailed information about the host system, including hardware specifications, installed software, and network configurations.
• Sensitive File Exfiltration: Searching for documents and files that may contain proprietary or confidential information.

The integration of these two malware families within the FakeGit campaign suggests a highly organized effort to monetize compromised access by selling stolen credentials or using them for further lateral movement within corporate networks.

The Rise of AgentBaiting: Social Engineering for AI

Perhaps the most concerning aspect of the FakeGit campaign is the emergence of AgentBaiting. As organizations increasingly deploy autonomous AI agents to handle routine tasks—such as finding and installing software plugins or configuring development environments—the threat actors have adapted their lures to exploit the way these agents "perceive" and process information.

AgentBaiting occurs when an AI agent, acting on a user’s prompt to find a specific tool or capability, autonomously discovers a FakeGit repository. Because the AI model is trained to interpret documentation and follow instructions, it treats the malicious README file as a legitimate guide. The agent may then surface the malicious link to the user or, in more advanced agentic workflows, attempt to execute the installation commands itself.

Testing conducted by researchers at Island revealed that leading AI models, including Anthropic’s Claude Code, Google’s Gemini, and OpenAI’s ChatGPT, are susceptible to this form of deception. In one scenario, a simple prompt such as "Find a free Walmart MCP server link" could lead the AI model to discover and recommend a malicious repository without any direct intervention from the attacker. This effectively turns the AI’s capability for discovery into a liability, as the model becomes an unwitting distributor of malware.

Chronology and Historical Context of the Campaign

The FakeGit campaign is not an isolated incident but rather the latest and most expansive evolution of a trend that began earlier in 2026.

• February 2026: Security firm Straiker AI first flagged the use of trojanized MCP servers to distribute SmartLoader and StealC. These early attacks were more limited in scope but demonstrated the viability of using AI-related tools as lures.
• Spring 2026: Researchers at Derp.ca identified a growing cluster of malicious GitHub repositories using LuaJIT loaders, linking them to a broader campaign they termed FakeGit.
• July 2026: Island’s comprehensive report revealed the true scale of the operation, documenting over 7,600 repositories and the specific "AgentBaiting" technique. The report highlighted that the campaign had achieved 14 million downloads, indicating a massive success rate in deceiving both humans and machines.

The rapid growth of FakeGit underscores the challenges faced by platform providers like GitHub in moderating content at scale. While GitHub has mechanisms to detect and remove malicious code, the sheer volume of repositories created by the FakeGit actors—utilizing over 6,600 unique profiles—presents a significant "whack-a-mole" problem for security teams.

The Role of Public Registries in Validating Malicious Content

A critical factor in the success of the FakeGit campaign is the exploitation of public registries for AI skills and MCP servers. Platforms such as LobeHub, Glama, MCP.so, and MCP Market serve as central hubs where developers and AI agents look for new capabilities.

By listing their malicious repositories on these registries, the attackers gain a "false sense of legitimacy." Users and AI agents are more likely to trust a tool that appears in a curated or popular registry than a random repository found through a search engine. Researchers have flagged more than 600 campaign listings across these public registries, many of which remained active for extended periods, allowing the malware to proliferate.

The presence of malicious tools on these platforms highlights a significant gap in the current AI ecosystem: the lack of rigorous vetting processes for third-party plugins and skills. As the "app store" model for AI agents continues to grow, the security of these registries will become a primary concern for the industry.

Technical Analysis of the Attack Chain

The technical sophistication of the FakeGit campaign is evident in its multi-stage execution process. The use of LuaJIT, a Just-In-Time compiler for the Lua programming language, is a deliberate choice by the attackers to evade traditional signature-based detection.

1. The Lure: The user or agent finds a repository with a README that promises a useful AI capability (e.g., an MCP server for Databricks).
2. The Download: The user is instructed to download a ZIP file from the GitHub Releases section. This file contains legitimate-looking files alongside the malicious components.
3. The Loader: Within the ZIP file, a launcher (often disguised as a setup utility) initiates the LuaJIT environment.
4. Obfuscated Scripting: An obfuscated Lua script is executed. Obfuscation makes it difficult for automated sandboxes and security researchers to analyze the script’s intent without manual intervention.
5. SmartLoader Deployment: The Lua script downloads or extracts SmartLoader, which is then injected into a legitimate system process to avoid detection.
6. Persistence and StealC: SmartLoader modifies system registry keys or creates scheduled tasks to ensure it runs upon reboot. It then contacts a Command and Control (C2) server to receive the StealC payload, which begins the data exfiltration process.

Implications for the AI Industry and Enterprise Security

The FakeGit campaign and the discovery of AgentBaiting have profound implications for the future of AI-assisted work. As organizations move toward "agentic" workflows—where AI is given more autonomy to interact with the web and install software—the attack surface expands significantly.

The fundamental issue is that AI models, while capable of processing vast amounts of information, lack the inherent skepticism and contextual awareness required to identify sophisticated social engineering. When an AI agent reads a README file, it interprets the text as documentation rather than a potential threat. This "trust by default" architecture is precisely what the FakeGit actors are exploiting.

For enterprises, this threat necessitates a reevaluation of how AI tools are integrated into the corporate environment. Allowing AI agents to download and execute code from public repositories without human oversight or a robust sandboxing mechanism is now a high-risk activity.

Recommended Defense and Mitigation Strategies

To counter the threats posed by the FakeGit campaign and the broader trend of AgentBaiting, cybersecurity experts recommend a multi-layered defense strategy focused on interrupting the chain of execution.

1. Curated Tool Catalogs: Organizations should move away from allowing agents to search public registries directly. Instead, they should build internal, reviewed catalogs of approved AI skills, MCP servers, and plugins.
2. Sandboxed Evaluation: Any new agent capability or third-party tool should be tested in a strictly isolated sandbox environment before being deployed to production or accessible to employees.
3. Verification of Publishers: Before integrating a tool from a platform like GitHub, security teams should verify the credibility of the publisher and the history of the project. A high number of downloads or stars is no longer a reliable indicator of safety, as these metrics can be easily manipulated.
4. Monitoring Agentic Pathways: Organizations should implement logging and monitoring for all actions taken by AI agents, particularly those involving network requests or file system modifications. This allows for the early detection of anomalous behavior.
5. Platform-Level Enhancements: Registry providers (like LobeHub and Glama) and code hosting platforms (like GitHub) must implement more rigorous automated scanning for malware in releases and increase the friction for creating mass-produced, lookalike developer profiles.

The FakeGit operation serves as a stark reminder that as technology evolves, so too do the methods of those who seek to exploit it. The shift from targeting humans to targeting the AI agents that assist them marks a new chapter in the ongoing battle between cybercriminals and security professionals. The defenses that will prove most effective are those that recognize this shift and build safeguards into the very fabric of AI discovery and execution.