FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware
The FakeGit campaign utilizes approximately 7,600 malicious GitHub repositories to distribute SmartLoader malware, with over 800 specifically masquerading as AI skills or Model Context Protocol (MCP) servers. A new vector called "AgentBaiting" allows AI agents like Claude Code, Gemini, and ChatGPT to autonomously discover and execute malicious instructions from fake repositories without human intervention. The attack chain involves downloading malicious ZIP files containing LuaJIT loaders that d
Analysis
TL;DR
- The FakeGit campaign utilizes approximately 7,600 malicious GitHub repositories to distribute SmartLoader malware, with over 800 specifically masquerading as AI skills or Model Context Protocol (MCP) servers.
- A new vector called "AgentBaiting" allows AI agents like Claude Code, Gemini, and ChatGPT to autonomously discover and execute malicious instructions from fake repositories without human intervention.
- The attack chain involves downloading malicious ZIP files containing LuaJIT loaders that drop SmartLoader, which subsequently deploys the StealC information stealer to harvest sensitive data.
- More than 600 listings from this campaign have been identified on public AI registries such as LobeHub, Glama, and MCP.so, exploiting the growing demand for third-party AI integrations.
Why It Matters
This incident highlights a critical shift in cybersecurity threats where AI agents themselves become targets for social engineering and supply chain attacks, bypassing traditional human-centric security controls. For AI practitioners and developers, it underscores the urgent need to secure the ecosystem of third-party skills, plugins, and MCP servers, which are increasingly becoming vectors for malware distribution. The ability of attackers to manipulate autonomous agents introduces new risks for enterprise environments relying on AI-driven workflows.
Technical Details
- Attack Vector: Malicious GitHub repositories posing as legitimate AI skills or MCP servers, often using copied projects, lookalike developer profiles, and convincing README files.
- Malware Chain: Downloads trigger a LuaJIT loader chain executing an obfuscated Lua script that installs SmartLoader, followed by the deployment of StealC information stealer.
- AgentBaiting Mechanism: AI models are prompted to search for specific tools (e.g., "free claude cinematic prompt skill"), leading them to autonomously fetch and process malicious repositories and their instructions.
- Targeted Models: Tests confirmed susceptibility in Anthropic Claude Code, Google Gemini, and OpenAI ChatGPT, which surfaced malicious repositories without explicit malicious links provided by the user.
- Distribution Scale: Over 14 million downloads recorded across GitHub Release assets in approximately 200 campaign repositories as of July 2026, with listings propagated through public registries.
Industry Insight
- Secure AI Supply Chains: Organizations must implement strict vetting processes for third-party AI skills and MCP servers, treating them with the same scrutiny as software dependencies in traditional development pipelines.
- Agent Sandboxing: AI agents should operate within sandboxed environments with restricted permissions to prevent autonomous execution of unverified code or commands discovered during search operations.
- Proactive Monitoring: Security teams should monitor public AI registries and GitHub for anomalies in repository creation patterns and developer profiles to detect campaigns like FakeGit before widespread adoption.
Disclaimer: The above content is generated by AI and is for reference only.