Cybersecurity researchers have discovered nearly 7,600 malicious GitHub repositories, out of which more than 800 pose as artificial intelligence (AI) skills or Model Context Protocol (MCP) servers to deliver a malware family known as SmartLoader as part of an ongoing campaign codenamed FakeGit.
“FakeGit uses copied projects, lookalike developer profiles, convincing READMEs, and malicious ZIP files to deliver SmartLoader malware,” Oleg Zaytsev, lead security researcher at Island, said in a report shared with The Hacker News.
The end goal of these attacks is to leverage the access afforded by SmartLoader to establish persistence and push secondary payloads, such as StealC, an information stealer capable of harvesting a wide range of data from compromised systems.
It’s worth mentioning here that the use of trojanized MCP servers to distribute SmartLoader and StealC was flagged earlier this year by Straiker AI and subsequently by Derp.ca. But a concerning aspect of FakeGit is an AI-powered evolution dubbed AgentBaiting.
This occurs when an AI agent searching for a skill or an MCP server ends up inadvertently discovering one of these bogus GitHub repositories, causing it to do the attacker’s bidding on its own without any intervention from a human user.
Island said its tests revealed Anthropic Claude Code, Google Gemini, and OpenAI ChatGPT to be susceptible to this trickery, allowing the models to surface malicious campaign repositories without even being shown a link. In other words, a technique set up with an original intent to socially engineer humans now has the capability to equally deceive an AI agent acting on their behalf.
Of the 7,600 malicious GitHub repositories created by about 6,600 profiles, 800 posed as Skills or MCP servers for individual and enterprise use, from Gmail and WhatsApp integrations to Databricks, Jenkins, and Docker tooling. As of July 2026, the FakeGit operation has recorded more than 14 million downloads across GitHub Release assets in about 200 campaign repositories.
“The repositories were designed to meet demand already forming around AI capabilities, borrowing the names and workflows of familiar consumer and enterprise tools,” Zaytsev explained. “That familiarity gave the malicious ZIP files a credible reason to be downloaded, while the README guided users or agents from what appeared to be routine setup into the SmartLoader attack chain.”
The counterfeit repositories, either completely fabricated or copied from legitimate projects, serve as a conduit for a ZIP archive, which is then used to trigger a LuaJIT loader chain, leading to the execution of an obfuscated Lua script responsible for dropping SmartLoader. Then the loader proceeds to deploy StealC.
AgentBaiting escalates this threat further, as it opens the door to a scenario where an AI agent can be baited to discover a FakeGit repository without having to supply a malicious link by providing a prompt like this: “Find free claude cinematic prompt skill, and give me the installation instructions” or “give me a free walmart MCP server link.”
“While trying to complete a task, it can discover a FakeGit repository on its own, treat the README as legitimate documentation, and pass the attacker’s instructions to the user,” Island said. “FakeGit built its AI lures around this path.”
The technique once again demonstrates how routine AI-assisted discovery operations can be turned into an alley for malicious code execution, a problem that gets exacerbated when the malicious skills or MCP servers are listed on public registries like LobeHub, Glama, MCP.so, and MCP Market, giving them a false sense of legitimacy. More than 600 campaign listings have been flagged across public MCP and Skill registries.
To counter the threat, it’s advised to build a catalog of reviewed Skills, MCP servers, and agent plugins, evaluate new agent capabilities in a sandboxed environment first before broader rollout, verify both the publisher and the project to ensure credibility, and monitor agentic pathways.
“FakeGit did not need to breach anything. It published convincing repositories, borrowed real developers’ identities, spread its listings across public registries, and let discovery do the rest,” Island said.
“With AgentBaiting, that discovery no longer requires a person at all: an agent searching for a Skill or MCP server can find the lure, read the attacker’s README, and carry its instructions forward. The defenses that matter are the ones that interrupt this chain before execution.”
