FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware

Cybersecurity researchers have uncovered a large-scale campaign dubbed FakeGit, which leverages nearly 7,600 malicious GitHub repositories to distribute the SmartLoader malware. The campaign, detailed by security firm Island, uses fake AI skills and Model Context Protocol (MCP) servers to trick users and AI agents into downloading malicious ZIP files.

According to Oleg Zaytsev, lead security researcher at Island, the repositories feature copied projects, lookalike developer profiles, and convincing README files to deliver SmartLoader. Once executed, SmartLoader establishes persistence and deploys secondary payloads such as StealC, an information stealer that harvests data from compromised systems.

A concerning evolution of this campaign is AgentBaiting, where AI agents like Anthropic Claude Code, Google Gemini, and OpenAI ChatGPT can be tricked into discovering and promoting these malicious repositories without human intervention. The attackers craft prompts that lead AI agents to find and recommend the fake repositories, effectively automating the social engineering process.

Of the 7,600 repositories created by about 6,600 profiles, 800 posed as Skills or MCP servers for tools like Gmail, WhatsApp, Databricks, Jenkins, and Docker. As of July 2026, the campaign has recorded over 14 million downloads across approximately 200 campaign repositories. The malicious ZIP files trigger a LuaJIT loader chain that executes an obfuscated Lua script to drop SmartLoader, which then deploys StealC.

To mitigate this threat, organizations are advised to maintain a catalog of reviewed Skills and MCP servers, evaluate new agent capabilities in sandboxed environments, verify publisher and project credibility, and monitor agentic pathways. The campaign highlights the growing risk of AI-assisted discovery being exploited for malware distribution.