A sophisticated malware campaign dubbed "FakeGit" has expanded into the AI ecosystem, using thousands of malicious GitHub repositories posing as AI Skills or MCP servers to deliver SmartLoader malware via malicious ZIP files. The novel "AgentBaiting" technique allows AI agents to autonomously discover and recommend these malicious repositories by treating their READMEs as legitimate documentation, which then leads to the installation of the StealC information stealer. The campaign peaked in April 2026, with over 7,600 repositories and more than 14 million measured downloads, creating a new attack surface where AI agents can inadvertently facilitate malware delivery.
Inside the 7,600-repository FakeGit operation that brought SmartLoader into the AI capability supply chain, using GitHub repositories, public AI registries, and agent-readable instructions to create a new enterprise attack surface. Oleg Zaytsev, Lead Security Researcher Island security research uncovered about 7,600 malicious GitHub repositories, with more than 800 of them posing as AI Skills or MCP servers in a wave that peaked in April 2026. Those AI capability repositories appeared more than 600 times across public AI registries and catalogs, while the wider FakeGit operation recorded more than 14 million measured downloads. FakeGit uses copied projects, lookalike developer profiles, convincing READMEs, and malicious ZIP files to deliver SmartLoader malware. Once executed, SmartLoader establishes persistence and installs StealC, an information stealer targeting credentials, active sessions, and other sensitive data. The most significant shift is a technique we call AgentBaiting. An AI agent searching for a new capability such as a Skill or an MCP server can discover a campaign repository on its own, treat the attacker's README as legitimate documentation, and hand the installation instructions to the user. In our testing, Claude Code, Gemini, and ChatGPT all surfaced malicious campaign repositories without ever being shown a link. A playbook built to deceive people now deceives the agents acting on their behalf. For years, FakeGit and SmartLoader have targeted developers through convincing GitHub projects that turn software discovery into malware delivery. In the latest wave we observed, the campaign expanded into the AI capability ecosystem, presenting malicious repositories as Skills and MCP servers and gaining exposure through public AI registries. This brought an established malware operation into the workflows people and agents use to discover and install new AI capabilities. Our investigation confirmed roughly7,600 malicious GitHub repositories, created by about 6,600 profiles, including about 1,400 tied to AI tools, agents, or workflows.Over 800 posed as Skills or MCP serversspanning individual and enterprise use, from Gmail and WhatsApp integrations to Databricks, Jenkins, and Docker tooling. The repository count tells only part of the story. As of July 2026, we measuredmore than 14 million downloadsacross GitHub Release assets in about 200 campaign repositories - including 149,015 forZilts345890/Golang-html-parsing, 120,872 forMRX-slayer/ai-resume-parser,and 69,969 forhuizuohaode/AI-Image-Generator. Thousands of other repositories embedded malicious ZIP files directly in the project, where downloads are not publicly counted. Within that broader operation, the latest AI wave developed quickly. GitHub creation dates show it building through March and peaking in April 2026, when nearly 300 AI-related repositories were created. The repositories were designed to meet demand already forming around AI capabilities, borrowing the names and workflows of familiar consumer and enterprise tools. That familiarity gave the malicious ZIP files a credible reason to be downloaded, while the README guided users or agents from what appeared to be routine setup into the SmartLoader attack chain. FakeGit builds credibility one layer at a time. It copies or fabricates projects, places them under convincing developer identities, and uses their READMEs to make malware execution look like a routine installation. Mann1988/awesome-claude-skillscopied the name and positioning of the originalComposioHQ/awesome-claude-skills, a widely used collection with more than 67,000 stars and 7,600 forks. The fake repository had accumulated 63 stars and 18 forks of its own, enough to appear established at a glance. Its README then presentedawesome-skills-claude-3.3.zip, a confirmed SmartLoader package, as the project’s download. The deception also extends to the profiles behind the projects. The campaign accountNaveenkm007differs by one character from established developerNaveenkm07and closely mirrors the original profile. It then uses that identity to publishNaveenkm007/spaceship-mcp, an MCP server containing a confirmed SmartLoader package. Once the repository and its owner appear credible, the README completes the attack.45d5r/databricks-mcp-servershows this handoff clearly. It presents itself as an enterprise integration with 263 Databricks tools, but its “Download Latest Release” button points to a malicious ZIP inside the repository. The instructions tell the reader to download it, extract it, and run the application. Those instructions end at the ZIP. The attack begins inside it. The Windows package linked from45d5r/databricks-mcp-server,server_databricks_mcp_1.6.zip, contains no Databricks installer, MCP manifest, or server setup. It contains only three files:application.cmd, luau.exe, andico64.txt. The launcher contains a single command: start luau.exe ico64.txt That command passesico64.txt to luau.exe, a renamed LuaJIT-style ...