Massive FakeGit Malware Campaign Targets AI Developers and Exploits LLM Agents Through AgentBaiting Techniques
Cybersecurity researchers have uncovered an expansive and sophisticated malicious operation dubbed FakeGit, which has successfully deployed nearly 7,600 fraudulent GitHub repositories to distribute information-stealing malware. According to a comprehensive report from security firm Island, more than 800 of these repositories specifically target the burgeoning field of artificial intelligence by posing as AI "skills" or Model Context Protocol (MCP) servers. The campaign represents a significant evolution in supply chain attacks, introducing a novel technique known as AgentBaiting, where Large Language Model (LLM) agents are inadvertently manipulated into delivering malware to users without direct human intervention.
The primary objective of the FakeGit campaign is the distribution of a malware family known as SmartLoader. This initial stage serves as a persistent foothold on a compromised system, allowing attackers to deploy secondary, more destructive payloads. Chief among these is StealC, a potent information stealer designed to exfiltrate sensitive data, including browser credentials, cryptocurrency wallets, session tokens, and system metadata. As of July 2026, the operation has reached a staggering scale, recording more than 14 million downloads across GitHub Release assets linked to approximately 200 high-traffic campaign repositories.
The Mechanics of the FakeGit Campaign
The FakeGit operation relies on a high degree of social engineering and technical mimicry to deceive both human developers and automated systems. Lead security researcher at Island, Oleg Zaytsev, noted that the threat actors behind the campaign utilized a multi-layered approach to establish credibility. This included the creation of approximately 6,600 developer profiles that were designed to look legitimate, often borrowing the identities of well-known contributors in the open-source community.
The malicious repositories themselves are frequently clones of popular, legitimate projects or entirely fabricated tools that fill a specific niche in the AI development ecosystem. These repositories feature professional-grade README files, complete with detailed installation instructions, badges, and documentation that mirrors the aesthetics of trusted software. The lures are specifically tailored to meet the surging demand for AI integration tools, including MCP servers for platforms like Gmail, WhatsApp, Databricks, Jenkins, and Docker.
When a user or an AI agent follows the installation instructions, they are typically directed to download a ZIP archive from the GitHub "Releases" section. This archive contains the initial infection vector. The attack chain leverages a LuaJIT loader, which executes an obfuscated Lua script. This script is responsible for the stealthy deployment of SmartLoader, which subsequently fetches and executes the StealC infostealer. By using LuaJIT, the attackers are often able to bypass traditional signature-based antivirus solutions that may not be configured to deeply inspect Lua scripts embedded within compressed archives.
AgentBaiting: The Next Frontier of AI Exploitation
The most concerning aspect of the FakeGit campaign is the emergence of "AgentBaiting." This technique exploits the way modern AI agents—such as Anthropic’s Claude Code, Google’s Gemini, and OpenAI’s ChatGPT—search for and recommend tools to users. As developers increasingly rely on AI to find libraries or set up environments, these agents act as intermediaries that can be deceived by the same social engineering tactics used against humans.
In testing conducted by Island, researchers found that these prominent AI models were susceptible to surfacing malicious FakeGit repositories when prompted with general queries. For example, if a user asks an AI agent to "find a free Walmart MCP server link" or "find a Claude cinematic prompt skill and provide installation instructions," the agent may crawl the web or public registries, identify a FakeGit repository as a top result, and present the attacker’s malicious instructions as legitimate documentation.
This creates a "blind trust" scenario. Because the recommendation comes from a trusted AI assistant, the user is significantly more likely to execute the commands or download the files provided. The AI agent, programmed to be helpful and efficient, effectively becomes an unwitting distributor for the malware. This evolution marks a transition from traditional social engineering, which requires direct interaction between the attacker and the victim, to an automated exploitation of the "agentic web."
Statistical Overview and Reach
The scale of the FakeGit operation suggests a highly organized and well-resourced threat actor. Data gathered by researchers provides a chilling look at the campaign’s success:
- Total Malicious Repositories: Approximately 7,600 identified across the GitHub platform.
- Unique Attacker Profiles: Roughly 6,600 accounts created to manage and host these repositories.
- AI-Specific Lures: Over 800 repositories posing as MCP servers or AI skills.
- Total Downloads: Exceeding 14 million downloads from GitHub Release assets as of mid-2026.
- Public Registry Penetration: More than 600 campaign listings have been identified on popular AI tool registries, including LobeHub, Glama, MCP.so, and MCP Market.
The inclusion of these malicious links on public registries is a critical component of the campaign’s success. These registries often lack rigorous vetting processes, allowing attackers to list their "skills" alongside legitimate tools. The presence of a tool on a community-recognized registry provides a false sense of security, which both human users and AI agents interpret as a signal of legitimacy.
Chronology of Discovery
The discovery of FakeGit was not a single event but the result of converging research from multiple cybersecurity entities over several months.
- Early 2026: Researchers at Straiker AI first flagged a series of trojanized MCP servers. These early iterations were observed using Oura-themed lures to distribute SmartLoader.
- Spring 2026: The research group Derp.ca identified a broader pattern of GitHub-based attacks using LuaJIT loaders. They coined the term "FakeGit" to describe the automated nature of the repository creation and the use of lookalike profiles.
- July 2026: Island published its "AgentBaiting" report, which connected the previous findings and revealed the specific targeting of AI agents. Island’s research highlighted how the campaign had pivoted to exploit the way LLMs discover and process information, leading to the massive download numbers reported.
Technical Analysis of the Payload
The secondary payload, StealC, is a well-known "Malware-as-a-Service" (MaaS) tool that has been active since early 2023. It is written in C and is prized by cybercriminals for its small footprint and extensive data-harvesting capabilities.
Once StealC is deployed via SmartLoader, it performs a series of system checks to ensure it is not running in a sandbox or a virtual machine. If the environment is deemed "safe" for execution, it begins scanning for sensitive files. It specifically targets over 70 different web browsers to steal saved passwords, cookies, and credit card information. Furthermore, it searches for desktop cryptocurrency wallets and browser-based wallet extensions. The stolen data is then compressed and exfiltrated to a Command and Control (C2) server controlled by the FakeGit operators.
The use of SmartLoader as an intermediary is a strategic choice. It allows the attackers to change the final payload easily without modifying the initial GitHub repository. If StealC becomes too easily detected, the attackers can simply update the SmartLoader configuration to drop a different infostealer or even ransomware.
Industry Implications and Expert Reactions
The FakeGit campaign has sent ripples through the cybersecurity and AI development communities. The ability of attackers to weaponize the "helpfulness" of AI agents poses a fundamental challenge to current security models.
"The defenses that matter are the ones that interrupt this chain before execution," said Oleg Zaytsev in the Island report. "FakeGit did not need to breach a perimeter. It published convincing repositories, borrowed real developers’ identities, spread its listings across public registries, and let discovery do the rest."
Security analysts suggest that this campaign marks the beginning of a new era of "AI-assisted supply chain poisoning." As organizations integrate AI agents into their DevOps pipelines and daily workflows, the surface area for these types of attacks grows exponentially. The traditional advice of "verifying the source" becomes much more difficult when the source is recommended by an AI that the user trusts.
Mitigation and Defense Strategies
In response to the FakeGit threat, cybersecurity experts are urging organizations and individual developers to adopt a more rigorous approach to adopting AI tools and MCP servers. Key recommendations include:
- Curated Catalogs: Instead of allowing developers or AI agents to pull tools from the open web, enterprises should maintain an internal, vetted catalog of approved AI skills and MCP servers.
- Sandboxed Evaluation: Any new agent plugin or tool should be evaluated in a strictly isolated environment. Security teams should monitor for unusual network activity or unauthorized file access during the "first run" of a new tool.
- Vetting Public Registries: Users should not assume that a listing on a site like LobeHub or MCP Market is safe. Always cross-reference the GitHub repository’s age, contributor history, and community feedback before downloading assets.
- Monitoring Agentic Pathways: Organizations should implement logging and monitoring for the actions taken by AI agents. If an agent recommends a download from a previously unknown or suspicious repository, it should trigger an automated security alert.
- Code Signing and Integrity: Developers are encouraged to look for signed releases and verify the hashes of any downloaded ZIP files against official documentation, although this remains difficult when the documentation itself is part of the lure.
The FakeGit campaign serves as a stark reminder that as technology evolves, so too do the tactics of threat actors. The shift from targeting humans to targeting the AI agents that assist humans represents a sophisticated pivot in the ongoing battle for digital security. As the "agentic web" continues to expand, the industry must develop new frameworks to ensure that the AI assistants of tomorrow do not become the malware delivery systems of today.
Related posts:
