Cybersecurity researchers have found practically 7,600 malicious GitHub repositories, out of which greater than 800 pose as synthetic intelligence (AI) expertise or Mannequin Context Protocol (MCP) servers to ship a malware household often known as SmartLoader as a part of an ongoing marketing campaign codenamed FakeGit.
“FakeGit makes use of copied initiatives, lookalike developer profiles, convincing READMEs, and malicious ZIP recordsdata to ship SmartLoader malware,” Oleg Zaytsev, lead safety researcher at Island, stated in a report shared with The Hacker Information.
The tip aim of those assaults is to leverage the entry afforded by SmartLoader to ascertain persistence and push secondary payloads, comparable to StealC, an data stealer able to harvesting a variety of knowledge from compromised methods.
It is value mentioning right here that the usage of trojanized MCP servers to distribute SmartLoader and StealC was flagged earlier this 12 months by Straiker AI and subsequently by Derp.ca. However a regarding side of FakeGit is an AI-powered evolution dubbed AgentBaiting.
This happens when an AI agent looking for a ability or an MCP server finally ends up inadvertently discovering one among these bogus GitHub repositories, inflicting it to do the attacker’s bidding by itself with none intervention from a human consumer.
Island stated its assessments revealed Anthropic Claude Code, Google Gemini, and OpenAI ChatGPT to be prone to this trickery, permitting the fashions to floor malicious marketing campaign repositories with out even being proven a hyperlink. In different phrases, a way arrange with an unique intent to socially engineer people now has the potential to equally deceive an AI agent appearing on their behalf.
Of the 7,600 malicious GitHub repositories created by about 6,600 profiles, 800 posed as Abilities or MCP servers for particular person and enterprise use, from Gmail and WhatsApp integrations to Databricks, Jenkins, and Docker tooling. As of July 2026, the FakeGit operation has recorded greater than 14 million downloads throughout GitHub Launch property in about 200 marketing campaign repositories.
“The repositories have been designed to satisfy demand already forming round AI capabilities, borrowing the names and workflows of acquainted client and enterprise instruments,” Zaytsev defined. “That familiarity gave the malicious ZIP recordsdata a reputable purpose to be downloaded, whereas the README guided customers or brokers from what seemed to be routine setup into the SmartLoader assault chain.”
The counterfeit repositories, both utterly fabricated or copied from reliable initiatives, function a conduit for a ZIP archive, which is then used to set off a LuaJIT loader chain, resulting in the execution of an obfuscated Lua script answerable for dropping SmartLoader. Then the loader proceeds to deploy StealC.
AgentBaiting escalates this menace additional, because it opens the door to a situation the place an AI agent might be baited to find a FakeGit repository with out having to provide a malicious hyperlink by offering a immediate like this: “Discover free claude cinematic immediate ability, and provides me the set up directions” or “give me a free walmart MCP server hyperlink.”
“Whereas attempting to finish a job, it could uncover a FakeGit repository by itself, deal with the README as reliable documentation, and go the attacker’s directions to the consumer,” Island stated. “FakeGit constructed its AI lures round this path.”
The method as soon as once more demonstrates how routine AI-assisted discovery operations might be became an alley for malicious code execution, an issue that will get exacerbated when the malicious expertise or MCP servers are listed on public registries like LobeHub, Glama, MCP.so, and MCP Market, giving them a false sense of legitimacy. Greater than 600 marketing campaign listings have been flagged throughout public MCP and Talent registries.
To counter the menace, it is suggested to construct a catalog of reviewed Abilities, MCP servers, and agent plugins, consider new agent capabilities in a sandboxed setting first earlier than broader rollout, confirm each the writer and the challenge to make sure credibility, and monitor agentic pathways.
“FakeGit didn’t must breach something. It revealed convincing repositories, borrowed actual builders’ identities, unfold its listings throughout public registries, and let discovery do the remainder,” Island stated.
“With AgentBaiting, that discovery now not requires an individual in any respect: an agent looking for a Talent or MCP server can discover the lure, learn the attacker’s README, and carry its directions ahead. The defenses that matter are those that interrupt this chain earlier than execution.”
