The FakeGit Campaign Evolves: Malicious GitHub Repositories Now Target AI Agents, Not Just Humans

Cybersecurity researchers have uncovered a sophisticated and evolving threat originating from GitHub, where nearly 7,600 malicious repositories have been identified. A significant portion of these, over 800, are designed to impersonate artificial intelligence (AI) skills or Model Context Protocol (MCP) servers. Their insidious purpose is to distribute a potent malware family known as SmartLoader, as part of an ongoing, cleverly orchestrated campaign codenamed "FakeGit." This campaign has recently taken a concerning turn with the emergence of "AgentBaiting," a new tactic that leverages AI agents themselves to spread the malware, bypassing traditional human social engineering.

The FakeGit campaign, meticulously detailed by Oleg Zaytsev, lead security researcher at Island, employs a multi-pronged strategy to achieve its malicious objectives. This includes the use of copied legitimate projects, the creation of deceptive developer profiles designed to mimic genuine contributors, the crafting of convincing README files that guide unsuspecting users or AI agents towards malicious actions, and the distribution of malicious ZIP files containing the initial malware payload. "FakeGit uses copied projects, lookalike developer profiles, convincing READMEs, and malicious ZIP files to deliver SmartLoader malware," Zaytsev stated in a report shared with The Hacker News.

The ultimate aim of these sophisticated attacks is to exploit the initial access gained through SmartLoader to establish a persistent presence on compromised systems. Once established, the attackers can then deploy secondary payloads, such as StealC, an information-stealing malware capable of exfiltrating a wide spectrum of sensitive data from affected devices. This includes credentials, financial information, and other personal data, significantly impacting individuals and organizations.

This is not the first instance of malicious actors exploiting the burgeoning AI ecosystem for nefarious purposes. Earlier this year, threat intelligence reports from Straiker AI and subsequently Derp.ca flagged the use of trojanized MCP servers to distribute SmartLoader and StealC. These earlier reports highlighted the growing trend of attackers capitalizing on the demand for AI-related tools and functionalities. However, the FakeGit campaign introduces a particularly alarming evolution: AgentBaiting.

AgentBaiting: Deceiving the Machines

AgentBaiting represents a significant escalation in the threat posed by FakeGit. This new tactic occurs when an AI agent, actively searching for a specific skill or an MCP server to integrate into its operations, inadvertently discovers one of these counterfeit GitHub repositories. The AI agent, lacking the inherent human discernment to identify the malicious intent, proceeds to execute the attacker’s directives without any direct intervention from a human user. This creates a scenario where AI, designed to assist and automate tasks, becomes an unwitting vector for malware dissemination.

Island’s research has demonstrated the susceptibility of prominent AI models to this deceptive technique. Tests revealed that large language models (LLMs) such as Anthropic Claude Code, Google Gemini, and OpenAI ChatGPT are vulnerable. These models can surface malicious campaign repositories even when not provided with a direct malicious link. This means a technique originally conceived to socially engineer humans now possesses the capability to equally deceive AI agents acting on behalf of users.

Scale and Scope of the FakeGit Operation

The sheer scale of the FakeGit operation is staggering. Researchers identified approximately 7,600 malicious GitHub repositories, created by around 6,600 deceptive profiles. Among these, a substantial 800 repositories were specifically designed to mimic legitimate AI skills or MCP servers. These impersonations covered a broad range of applications, from essential personal and enterprise tools like Gmail and WhatsApp integrations to critical developer and infrastructure tools such as Databricks, Jenkins, and Docker.

As of July 2026, the FakeGit operation has demonstrated a significant reach, with its malicious GitHub Release assets recording over 14 million downloads across approximately 200 distinct campaign repositories. This high download count underscores the effectiveness of the campaign’s deceptive tactics and the broad appeal of the fake AI tools being offered.

Deceptive Tactics and Technical Execution

"The repositories were designed to meet demand already forming around AI capabilities, borrowing the names and workflows of familiar consumer and enterprise tools," Zaytsev explained. "That familiarity gave the malicious ZIP files a credible reason to be downloaded, while the README guided users or agents from what appeared to be routine setup into the SmartLoader attack chain."

The technical execution of the FakeGit attack chain is multi-staged and designed for stealth. Counterfeit repositories, which are either entirely fabricated or cleverly copied from legitimate open-source projects, serve as the initial lure. These repositories contain a ZIP archive. Upon download and extraction, this archive triggers a LuaJIT loader chain. This chain is responsible for executing an obfuscated Lua script, which in turn drops the SmartLoader malware onto the victim’s system. Following the successful deployment of SmartLoader, the loader then proceeds to install and execute StealC, the information-stealing component.

The AI-Driven Escalation: AgentBaiting in Practice

The AgentBaiting technique represents a paradigm shift in how these attacks are executed. It opens the door to a scenario where an AI agent, performing a routine search for a specific functionality, can autonomously discover a FakeGit repository without any human intervention. For instance, a prompt such as "Find free claude cinematic prompt skill, and give me the installation instructions" or "give me a free walmart MCP server link" could lead an AI agent to stumble upon a malicious repository.

"While trying to complete a task, it can discover a FakeGit repository on its own, treat the README as legitimate documentation, and pass the attacker’s instructions to the user," Island observed. "FakeGit built its AI lures around this path." This means that the AI agent, believing it is following authentic documentation, can inadvertently relay the attacker’s instructions for malware installation or execution to the end-user. The AI, intended to be a tool for efficiency and security, becomes a conduit for the attacker’s agenda.

Broader Implications for AI Security

This development is a stark reminder that as AI agents become more autonomous and integrated into workflows, they can become prime targets for exploitation. The FakeGit campaign demonstrates how routine AI-assisted discovery operations can be weaponized, transforming them into pathways for malicious code execution. This problem is significantly exacerbated when these malicious skills or MCP servers are listed on public registries, such as LobeHub, Glama, MCP.so, and MCP Market. These platforms, intended to facilitate the discovery and sharing of AI tools, inadvertently lend a false sense of legitimacy to the deceptive repositories. Island reported that over 600 campaign listings have been identified across these public MCP and Skill registries.

The implications of this threat are far-reaching:

• Erosion of Trust in AI Ecosystems: The success of FakeGit and AgentBaiting could lead to a significant erosion of trust in AI platforms and the repositories that host AI-related tools. Users and developers may become increasingly wary of integrating new AI functionalities, slowing down innovation.
• Increased Attack Surface for Organizations: As organizations increasingly rely on AI agents and integrations, the risk of falling victim to such campaigns grows. A compromised AI agent could lead to widespread data breaches or system compromise.
• The Need for Enhanced AI Security Measures: This incident highlights the urgent need for robust security measures specifically designed for AI agents and their interaction with external resources. Traditional security approaches may not be sufficient to address AI-specific vulnerabilities.
• Evolving Threat Landscape: The evolution from social engineering humans to baiting AI agents signifies a rapid advancement in attacker methodologies. This demands continuous adaptation and innovation in cybersecurity defense strategies.

Recommendations for Mitigation

To effectively counter this evolving threat, cybersecurity experts recommend a multi-layered approach:

• Curated Catalogs of Trusted Resources: Organizations should strive to build and maintain catalogs of reviewed and verified AI skills, MCP servers, and agent plugins. This involves a rigorous vetting process before any new capability is integrated.
• Sandboxed Evaluation of New Capabilities: Any new AI capabilities or agent functionalities should be evaluated in a secure, sandboxed environment before broader rollout. This allows for the identification of potential malicious behaviors without risking production systems.
• Publisher and Project Verification: It is crucial to verify both the publisher’s identity and the credibility of the project before downloading or integrating any AI-related software. This includes scrutinizing developer profiles, project history, and community feedback.
• Monitoring of Agentic Pathways: Organizations need to implement robust monitoring mechanisms to track the pathways and interactions of their AI agents. This can help detect unusual or suspicious activity that might indicate an AgentBaiting attack.

A New Era of Cyber Threats

The FakeGit campaign, particularly its AgentBaiting evolution, illustrates a concerning trend: attackers are adapting their strategies to exploit the very technologies designed to improve efficiency and security. "FakeGit did not need to breach anything," Island concluded. "It published convincing repositories, borrowed real developers’ identities, spread its listings across public registries, and let discovery do the rest."

The innovation of AgentBaiting further amplifies this effectiveness. "With AgentBaiting, that discovery no longer requires a person at all: an agent searching for a Skill or MCP server can find the lure, read the attacker’s README, and carry its instructions forward," the researchers emphasized. This shifts the burden of detection from human vigilance to the inherent security of AI systems and the platforms they interact with. The critical defense lies in interrupting this chain of execution before the malware can be deployed, underscoring the need for proactive security measures and continuous adaptation in the face of rapidly evolving cyber threats. The battle for digital security has entered a new phase, where both human users and the AI agents they employ are potential targets, necessitating a comprehensive and forward-thinking approach to cybersecurity.