FakeGit Campaign Leverages 7,600 GitHub Repositories to Distribute SmartLoader Malware
The FakeGit campaign has compromised nearly 7,600 GitHub repositories, using them to distribute the SmartLoader malware, with a concerning AI-driven evolution dubbed AgentBaiting.
Cybersecurity researchers have uncovered a widespread campaign dubbed FakeGit, which has compromised nearly 7,600 GitHub repositories. A significant portion of these, over 800, are designed to impersonate artificial intelligence (AI) skills or Model Context Protocol (MCP) servers. The primary objective of these malicious repositories is to distribute a malware family known as SmartLoader.
The campaign employs a multi-pronged approach to deceive potential victims. This includes using copied legitimate projects, creating fake developer profiles, crafting convincing README files, and distributing malicious ZIP archives. The ultimate goal of these attacks is to gain persistence on compromised systems and deploy secondary payloads, such as StealC, an information stealer capable of harvesting sensitive data.
While the distribution of SmartLoader and StealC via trojanized MCP servers was previously noted, FakeGit introduces a concerning evolution: AgentBaiting. This new tactic exploits AI agents themselves. An AI agent, when searching for a specific skill or MCP server, can inadvertently discover one of these bogus GitHub repositories, effectively being tricked into executing the attacker's commands without human intervention.
Researchers demonstrated that popular AI models like Anthropic Claude Code, Google Gemini, and OpenAI ChatGPT are susceptible to this trickery. These models can surface malicious campaign repositories simply by being prompted to find specific functionalities, without needing a direct malicious link. This means a technique originally designed for social engineering humans can now equally deceive AI agents acting on their behalf.
Out of the 7,600 malicious repositories created by approximately 6,600 profiles, 800 specifically mimicked Skills or MCP servers for both individual and enterprise use. These ranged from integrations for common tools like Gmail and WhatsApp to enterprise solutions such as Databricks, Jenkins, and Docker. As of July 2026, the FakeGit operation has seen over 14 million downloads from GitHub Release assets across roughly 200 campaign repositories.
The counterfeit repositories, which are either entirely fabricated or copied from legitimate projects, act as a conduit for a ZIP archive. Upon execution, this archive triggers a LuaJIT loader chain, leading to the deployment of an obfuscated Lua script responsible for dropping SmartLoader. Subsequently, the loader proceeds to deploy the StealC information stealer.
The AgentBaiting technique significantly escalates the threat by enabling AI agents to discover FakeGit repositories autonomously. An agent prompted to find a "free claude cinematic prompt skill" or a "free walmart MCP server link," for instance, could find a malicious repository, treat its README as legitimate documentation, and then pass the attacker's instructions to the user. This bypasses the need for direct human interaction in the initial discovery phase.
This campaign highlights how routine AI-assisted discovery operations can be weaponized for malicious code execution. The problem is exacerbated when these fake skills or MCP servers are listed on public registries like LobeHub, Glama, MCP.so, and MCP Market, lending them a false sense of legitimacy. Over 600 campaign listings have been flagged across these public registries. To counter this threat, security experts recommend building catalogs of reviewed Skills and MCP servers, evaluating new agent capabilities in sandboxed environments, verifying publisher and project credibility, and monitoring agentic pathways.