- The FakeGit attack has created over 7000 malicious GitHub repositories on about 6,600 developer profiles.
- More than 800 repositories mimic AI skillsets and MCP servers through a new tactic dubbed “AgentBaiting” that tricks AI assistants to recommend the malware-laden repositories.
- The campaign boasts 14 million downloads and distributes SmartLoader malware, which leads to StealC info-stealer malware installation.
A major malware campaign is leveraging thousands of fake GitHub repos to spread the malware. This campaign, termed “FakeGit,” is designed to deceive both developers and AI agents.
Researchers at security firm Island discovered that there are about 7,600 such malicious repositories. Out of those, more than 800 fakes themselves are posing as AI skills and Model Context Protocol servers.
The Malware Campaign Builds Credibility by Copying Real GitHub Projects
The people behind this FakeGit campaign designed it to fool its victims by using imitation techniques. In order to gain credibility, attackers copy legitimate projects and create similar developer accounts. They create realistic README files and forge the number of stars and fork counts to make the repositories look legit.
The tactic of building credibility through imitation is also seen in website hijacking campaigns, where hackers have taken over 250 sites, including a Harvard blog.
One of such fake repositories copied the name and structure of a real project that has more than 67 thousand stars. The fake one gathered 63 stars and 18 forks of its own, making it look like an established project at first glance.
The attackers also go after profiles of developers behind the legitimate projects. For example, one account differs from a real one by only one letter. It copied the original profile information before launching its malicious MCP server.
Imitation includes the copying of legitimate software products like Gmail, WhatsApp, Databricks, Jenkins, and Docker. Their descriptions redirect users to downloading fake ZIP packages containing Lua payloads that trigger SmartLoader.
The Malware Attack Chain
After SmartLoader infects a victim, it establishes persistence using scheduled tasks. It fetches its C2 server from a Polygon smart contract. The malware will then download other encrypted stages from GitHub before deploying the StealC info-stealer to the target system.
StealC steals the passwords, cookies, active session IDs, email account credentials, and screenshots from browsers. This attack chain is familiar, but the infection vector is new.
FakeGit Uses AgentBaiting to Target AI Assistants
The researchers at Island identified one technique they refer to as “AgentBaiting.” This method is meant to enhance the visibility of malicious repositories to AI agents.
For example, when searching for a new capability, an AI agent can discover a FakeGit repository by itself. It can treat an attacker’s README as legitimate documentation and pass on the installation instructions to the user.
Island tested this on Gemini, Claude Code, and ChatGPT. All these models revealed malicious campaign repositories while performing related tasks.
When asked to suggest which one of the two repositories should be used, Claude suggested both – the legitimate repository and the malicious one. While recommending the legitimate one, Claude also provided installation instructions for the malicious one and told the user to download an .exe file and ignore the security message from Windows.
In some instances, Claude reviewed the repository more carefully and did not recommend it. That is the risk. The AI agent on its own discovered a campaign repository and, in certain cases, turned attacker-written README into guidance to install it.
Something similar happened with Gemini. When the researchers asked the agent to provide a repository for the free Walmart MCP server, its top recommendation was a malicious repository.
ChatGPT also suggested the same malicious repository, singling it out as the right place to begin.
Public Registries Add Credibility to the Malware
Over 600 listings appeared in public AI registries and catalogs, including Glama, LobeHub, MCP Market, and MCP.so. In one instance, the listing reproduced the README file from the repository, transferring the malicious download link to a new platform using the credibility of the registry.
Accessing the Scale of Impact
GitHub public download counters for 335 Release assets across 211 campaign repositories reported more than 14 million downloads.
According to Island’s Lead Security Researcher, Oleg Zaytsev, this number does include automated activity as well as repeated requests. Therefore, it should not be considered as confirmed infections.
Nonetheless, the numbers are significant as this operation involved over 6,600 accounts. AI-driven attacks kept picking up steam through March, then completely exploded in April, with nearly 300 AI repositories created in a single month.
The island suggests several defense mechanisms. Companies need to have approved catalogs of skills and MCP servers. In addition, they need to test their capabilities in isolated environments prior to the wider deployment. They also need to check their publishers and repositories independently.
In case of the execution of SmartLoader, all secrets in affected environments must be changed instantly. Password changes are not sufficient since StealC steals active sessions, not passwords.
