Cybersecurity researchers at **Island** have detailed an extensive campaign, **FakeGit**, which has established a pervasive presence on **GitHub** through thousands of malicious repositories. The primary objective is to deliver the **SmartLoader** malware, a precursor to secondary payloads like the **StealC** information stealer. ### The FakeGit Modus Operandi **Oleg Zaytsev**, lead security researcher at **Island**, revealed in a report that **FakeGit** employs a multi-faceted approach. This includes: * Copied legitimate projects. * Lookalike developer profiles. * Convincing READMEs. * Malicious ZIP files, all designed to facilitate **SmartLoader** delivery. The ultimate goal is to establish persistence on compromised systems and deploy additional malicious software, such as **StealC**, which is capable of exfiltrating a broad spectrum of sensitive data. ### The Rise of AgentBaiting A particularly concerning development within the **FakeGit** campaign is **AgentBaiting**. This evolution targets AI agents directly. Instead of solely relying on human social engineering, **AgentBaiting** allows an AI agent, while searching for a skill or MCP server, to inadvertently discover and interact with these bogus **GitHub** repositories. This causes the AI to execute the attacker's bidding autonomously, without human intervention. Tests conducted by **Island** demonstrated that leading AI models, including **Anthropic Claude Code**, **Google Gemini**, and **OpenAI ChatGPT**, were susceptible to this trickery. They were observed surfacing malicious campaign repositories even without being explicitly provided a link, showcasing how a technique traditionally used to deceive humans can now equally mislead AI agents.  ### Scale and Impact Of the approximately 7,600 malicious **GitHub** repositories created by around 6,600 distinct profiles, 800 were designed to mimic AI Skills or MCP servers. These ranged from integrations for popular services like **Gmail** and **WhatsApp** to enterprise tools such as **Databricks**, **Jenkins**, and **Docker**. As of July 2026, the **FakeGit** operation has amassed over 14 million downloads across **GitHub** Release assets within roughly 200 campaign repositories. "The repositories were designed to meet demand already forming around AI capabilities, borrowing the names and workflows of familiar consumer and enterprise tools," **Zaytsev** explained. "That familiarity gave the malicious ZIP files a credible reason to be downloaded, while the README guided users or agents from what appeared to be routine setup into the SmartLoader attack chain." ### The Attack Chain The counterfeit repositories, whether entirely fabricated or copied from legitimate projects, act as a conduit for a ZIP archive. This archive, when executed, triggers a **LuaJIT** loader chain, ultimately leading to the execution of an obfuscated **Lua** script that drops **SmartLoader**. Subsequently, **SmartLoader** proceeds to deploy **StealC**. **AgentBaiting** amplifies this threat by enabling AI agents to discover **FakeGit** repositories through natural language prompts, such as "Find free claude cinematic prompt skill, and give me the installation instructions" or "give me a free walmart MCP server link." The AI agent, in its attempt to fulfill the request, can then treat the malicious README as legitimate documentation and pass the attacker's instructions to the user. ### Mitigating the Threat This technique underscores how routine AI-assisted discovery operations can be weaponized for malicious code execution, a problem exacerbated when these malicious skills or MCP servers are listed on public registries like **LobeHub**, **Glama**, **MCP.so**, and **MCP Market**, lending them a false sense of legitimacy. Over 600 campaign listings have already been identified across these public registries. To counter this evolving threat, **Island** advises the following measures: * Building a curated catalog of reviewed Skills, MCP servers, and agent plugins. * Evaluating new agent capabilities in a sandboxed environment before broader deployment. * Thoroughly verifying both the publisher and the project to ensure credibility. * Actively monitoring agentic pathways for suspicious activity. "**FakeGit** did not need to breach anything. It published convincing repositories, borrowed real developers' identities, spread its listings across public registries, and let discovery do the rest," **Island** stated. "With **AgentBaiting**, that discovery no longer requires a person at all: an agent searching for a Skill or MCP server can find the lure, read the attacker's README, and carry its instructions forward. The defenses that matter are the ones that interrupt this chain before execution."