Full Report
Cybersecurity researchers have discovered nearly 7,600 malicious GitHub repositories, out of which more than 800 pose as artificial intelligence (AI) skills or Model Context Protocol (MCP) servers to deliver a malware family known as SmartLoader as part of an ongoing campaign codenamed FakeGit. "FakeGit uses copied projects, lookalike developer profiles, convincing READMEs, and malicious ZIP
Analysis Summary
# Incident Report: Campaign FakeGit (AgentBaiting)
## Executive Summary
The "FakeGit" campaign is a large-scale malware distribution operation utilizing approximately 7,600 malicious GitHub repositories to deliver the SmartLoader and StealC malware families. A significant portion of the campaign (800+ repos) specifically targets the AI ecosystem by posing as Model Context Protocol (MCP) servers and AI "skills." The campaign introduced "AgentBaiting," a sophisticated technique where AI agents (such as Claude Code, Gemini, and ChatGPT) are autonomously deceived into discovering and recommending malicious repositories to users.
## Incident Details
- **Discovery Date:** Initial flags in February 2024; comprehensive report July 2026
- **Incident Date:** Ongoing (Active as of July 2026)
- **Affected Organization:** Open-source community, specifically users of GitHub and AI Agent platforms
- **Sector:** Technology / Artificial Intelligence / Software Development
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** Active throughout 2026
- **Vector:** AgentBaiting and Social Engineering
- **Details:** Attackers created ~7,600 repositories using ~6,600 fake lookalike developer profiles. They utilized cloned READMEs from legitimate enterprise tools (Gmail, WhatsApp, Docker, Jenkins) to appear authentic.
### Lateral Movement
- **Details:** High-level lateral movement is not the primary goal; instead, the malware focuses on local persistence and data harvesting to facilitate future credential-based intrusions into corporate environments.
### Data Exfiltration/Impact
- **Details:** The secondary payload, **StealC**, harvests browser data, credentials, and sensitive system information from the infected host.
### Detection & Response
- **How it was discovered:** Identified by researchers at Island, with earlier sightings by Straiker AI and Derp.ca.
- **Response actions taken:** Security researchers flagged over 600 listings across public MCP registries (LobeHub, Glama, MCP.so); GitHub was notified of the malicious repositories.
## Attack Methodology
- **Initial Access:** Social engineering via "AgentBaiting" (tricking AI agents into recommending malicious repos) and SEO/Registry poisoning.
- **Persistence:** SmartLoader establishes a footprint on the host to deploy further payloads.
- **Defense Evasion:** Use of LuaJIT loader chains and obfuscated Lua scripts to bypass traditional signature-based detection.
- **Credential Access:** Deployment of **StealC** info-stealer to harvest saved passwords and session tokens.
- **Discovery:** AI agents autonomously crawl public registries/GitHub for "skills" and surface malicious results.
- **Impact:** System compromise, data theft, and 14 million+ downloads of malicious assets.
## Impact Assessment
- **Financial:** Not disclosed, but potential for massive loss via stolen credentials.
- **Data Breach:** High volume of personal and corporate credentials via StealC.
- **Operational:** Disruption of AI-assisted development workflows.
- **Reputational:** Impersonation of legitimate developers and popular enterprise tools.
## Indicators of Compromise
- **Network indicators:** Connections to known StealC C2 infrastructure (defanged: *hxxp[://]stealc-cnc[.]com*).
- **File indicators:** Malicious ZIP archives in GitHub Releases; presence of `luajit.exe` or obfuscated `.lua` scripts in temp directories.
- **Behavioral indicators:** AI agents recommending unverified third-party repositories for "MCP servers" or generic "AI skills."
## Response Actions
- **Containment:** Removal of malicious listings from public MCP registries.
- **Eradication:** Deletion of the 7,600 identified GitHub repositories.
- **Recovery:** Users must rotate all credentials if they have interacted with FakeGit ZIP files.
## Lessons Learned
- **AI Vulnerability:** AI agents are susceptible to the same social engineering triggers as humans but at a much higher scale and speed.
- **Registry Trust:** Public registries for MCP servers and AI skills currently lack the rigorous verification required to prevent malware distribution.
- **Automation Risks:** Allowing AI agents to "install" or "fetch" instructions from unverified internet sources creates an unmonitored attack vector.
## Recommendations
- **Cataloging:** Maintain a curated, internal "allow-list" of reviewed AI skills and MCP servers.
- **Sandboxing:** Evaluate any third-party AI agent plugin or MCP server in a strictly isolated environment before corporate use.
- **Verification:** Manually verify the publisher and repository history (stars, age, contributor activity) before downloading assets.
- **Agent Monitoring:** Implement logging and monitoring for "agentic pathways" to see what external resources agents are accessing.