FakeGit campaign uses 7,600 GitHub repos to push SmartLoader malware

Cybersecurity researchers have uncovered a massive, sophisticated influence and malware distribution operation named "FakeGit," which leverages thousands of fraudulent GitHub repositories to infect developers and automated AI systems with data-stealing payloads. The campaign, which has been linked to the threat actor known as "Water Kurita," represents a significant evolution in software supply chain attacks by specifically targeting the burgeoning ecosystem of Artificial Intelligence (AI) agents and Model Context Protocol (Protocol) servers. By manipulating the "social proof" of GitHub repositories—such as star counts and fork numbers—and poisoning public AI registries, the attackers have successfully facilitated over 14 million download events, posing a severe risk to the integrity of development environments worldwide.

The Architecture of the FakeGit Operation

The FakeGit campaign is characterized by its sheer scale and its meticulous imitation of legitimate software projects. According to a detailed technical analysis by researchers at the enterprise browser platform Island, the operation utilizes at least 7,600 malicious GitHub repositories. These repositories are not merely low-effort clones; they are designed to deceive both human developers and automated tools through a variety of deceptive techniques.

To build credibility, the threat actors employ automated bots to inflate repository metrics. Many of the 7,600 identified repos feature fabricated star counts and fork numbers, making them appear popular and trustworthy to unsuspecting users. Furthermore, the repositories often impersonate high-profile consumer and enterprise tools. Researchers found clones and "alternative versions" of software associated with Gmail, WhatsApp, Databricks, Jenkins, and Docker. These fake projects include convincing documentation, copied descriptions from legitimate projects, and even the names of real developer accounts to further the illusion of authenticity.

The primary goal of these repositories is to lure users into downloading a ZIP archive, typically presented as a project release, an installer, or a "required dependency." These archives do not contain the promised software but instead house disguised Lua payloads designed to initiate the infection chain.

Evolution of the Attack: The Rise of AgentBaiting

The most innovative and concerning aspect of the FakeGit campaign is a technique researchers have dubbed "AgentBaiting." This strategy marks a shift from traditional social engineering, which targets human psychology, to a method that exploits the way AI agents and Large Language Models (LLMs) process information.

Beginning in March 2026 and reaching a peak in April, the threat actors pivoted their focus toward AI tools, agents, and workflows. Island’s researchers identified more than 1,400 repositories specifically related to AI development. Of these, over 800 were disguised as AI "skills" or Model Context Protocol (MCP) servers. MCP is an open standard that allows AI models to connect to external data sources and tools, making it a critical component of the modern AI agent ecosystem.

By submitting these malicious repositories to public AI registries and catalogs, the attackers ensured their "poisoned" tools would be indexed by the very systems developers use to find AI extensions. The campaign successfully penetrated several prominent directories, including LobeHub, Glama, MCP.so, and MCP Market, where malicious listings appeared more than 600 times.

When a developer or an autonomous AI agent searches for a tool to perform a specific task—such as "connect ChatGPT to a SQL database"—the AI agent may parse the README file of a FakeGit repository. Because the documentation is written to look legitimate, the AI agent identifies it as a valid solution and recommends it to the human operator. In some cases, the agent may even attempt to download and execute the "tool" automatically if granted sufficient permissions.

The Technical Infection Chain and Payload Delivery

The FakeGit attack chain is a multi-stage process designed to bypass traditional signature-based detection and establish long-term persistence on the victim’s machine.

1. Initial Access: The user or an AI agent downloads a ZIP file from a FakeGit repository. This archive contains a malicious Lua script disguised as a legitimate component.
2. SmartLoader Activation: Once executed, the Lua script triggers "SmartLoader." SmartLoader is a sophisticated malware stager that serves as the gateway for subsequent payloads. It immediately establishes persistence by creating scheduled tasks within the Windows operating system, ensuring it survives system reboots.
3. C2 Retrieval via Blockchain: In a move to evade network-level filtering and domain blacklisting, SmartLoader utilizes a decentralized method to find its command-and-control (C2) server. It queries a specific Polygon smart contract to retrieve the current C2 IP address. This "Dead Drop Resolver" technique makes it extremely difficult for defenders to shut down the communication channel.
4. Payload Deployment: After connecting to the C2, SmartLoader downloads additional encrypted stages directly from GitHub, leveraging the platform’s reputation to mask malicious traffic. The final payload is typically StealC, a potent information-stealing malware.
5. Data Exfiltration: StealC is designed to scan the infected system for sensitive information, including browser cookies, saved passwords, cryptocurrency wallets, and session tokens for platforms like Discord and Telegram. Once gathered, this data is compressed and exfiltrated to the attacker’s server.

Chronology of the Water Kurita Campaign

The FakeGit operation is not an isolated incident but rather a continuation and expansion of previous activities attributed to the threat actor "Water Kurita." Cybersecurity firm Trend Micro has tracked this actor for several years, noting their evolution from simpler malware distribution methods to the current large-scale GitHub infrastructure.

• Pre-2026: Water Kurita was primarily known for distributing Lumma Stealer through cracked software sites and YouTube descriptions.
• March 2026: Island researchers observed the first significant shift toward AI-themed repositories. The attackers began creating repos for "AI assistants" and "automated coding tools."
• April 2026: The campaign reached its zenith. Over 300 AI-related repositories were created in a single month. The "AgentBaiting" technique was fully realized as the actors began targeting MCP registries.
• May – July 2026: The infrastructure expanded to its current size of 7,600 repositories. The attackers refined their use of Polygon smart contracts to ensure the resilience of their C2 infrastructure.
• July 2026: Island and BleepingComputer released reports detailing the scale of the campaign, identifying over 14 million cumulative download events across the network of fake repositories.

Analysis of Impact and Official Responses

The impact of the FakeGit campaign is difficult to quantify precisely due to the nature of GitHub’s public metrics. While the 14,084,688 download events recorded across 211 analyzed repositories suggest a massive reach, researchers urge caution in interpreting these numbers. Oleg Zaytsev, Lead Security Researcher at Island, noted that these figures include repeated requests from automated scrapers, bots, and CI/CD pipelines, meaning the number of actual human infections is likely lower than the raw download count.

However, the qualitative impact on the AI development ecosystem is undeniable. In controlled testing, researchers found that popular AI models, including ChatGPT, Gemini, and Claude, would occasionally recommend these malicious repositories when prompted with specific development tasks. In one notable test, "Claude Code"—an experimental tool for terminal-based coding—cloned a malicious repository and downloaded the files onto the test machine. While the agent’s built-in safety filters eventually flagged suspicious indicators and prevented execution, the incident highlighted a critical vulnerability in the "autonomous" nature of modern AI agents.

GitHub has historically struggled with "star-botting" and repository spam. While the platform frequently removes malicious accounts, the automated nature of the FakeGit campaign allows the attackers to regenerate their infrastructure faster than it can be taken down. As of the time of reporting, many of the identified repositories remain active, though GitHub has been notified of the specific clusters identified by Island and Trend Micro.

Broader Implications for the Software Supply Chain

The FakeGit campaign signals a new era in cyber threats, where the "trust" built into open-source platforms is weaponized against the next generation of computing. The emergence of AgentBaiting suggests that threat actors are no longer just looking for human errors but are actively searching for "algorithmic errors"—ways to trick the logic of AI agents into compromising the systems they are meant to assist.

This shift necessitates a change in how organizations approach security. The traditional advice of "checking the number of stars" on a repository is no longer sufficient, as these metrics are easily manipulated. Furthermore, as developers increasingly rely on AI agents to write and source code, the "man-in-the-middle" is no longer a network interceptor but a poisoned AI suggestion.

Security experts recommend that organizations implement strict policies regarding the use of AI agents and external repositories:

• Isolated Environments: AI agents should only be allowed to download and test code in "sandboxed" or containerized environments that have no access to sensitive corporate data.
• Approved Catalogs: Enterprises should maintain their own internal, vetted catalogs of MCP servers and AI skills rather than allowing agents to pull from public registries.
• Verification Protocols: Human developers must independently verify the authenticity of a repository, looking for discrepancies in commit history and contributor profiles that bots cannot easily fake.
• Secrets Management: In the event of a suspected SmartLoader infection, organizations must immediately rotate all credentials, including API keys, SSH keys, and cloud service tokens, as StealC is specifically designed to harvest these "secrets."

As AI continues to integrate into the software development lifecycle, the FakeGit campaign serves as a stark reminder that the tools designed to increase productivity can also become the primary vectors for compromise if left unmonitored.