7,600 Repositories. 6,600 Fake Profiles. 14 Million Downloads.
Those numbers alone should make any developer pause. But here’s the part that keeps me up at night: over 800 of those repos posed as AI skills or MCP servers — the exact kind of tools developers like me are actively searching for right now.
Security researchers at Island have been tracking an ongoing campaign they call FakeGit, and the scale of it is unlike anything I’ve seen in the supply chain attack space. Nearly 7,600 malicious GitHub repositories, operated by about 6,600 fake profiles, all designed to do one thing: trick you into downloading SmartLoader malware disguised as a useful AI tool.
And thanks to a tactic they’re calling AgentBaiting, you don’t even need to click a malicious link anymore. Your AI coding assistant might find one for you.
What Is FakeGit?
FakeGit is a coordinated malware distribution campaign that floods GitHub with counterfeit repositories. Some are copies of legitimate projects with malware injected. Others are entirely fabricated — complete with convincing READMEs, professional-looking profiles, and even fake commit histories.
The lure? AI tools, MCP servers, and developer utilities. Things like Gmail integrations, WhatsApp bots, Databricks connectors, Jenkins plugins, and Docker tooling. The kind of stuff developers instinctively search for when they’re building something.
“The repositories were designed to meet demand already forming around AI capabilities,” explained Oleg Zaytsev, lead security researcher at Island. “That familiarity gave the malicious ZIP files a credible reason to be downloaded.”
Once you download that ZIP, the attack chain kicks off: a LuaJIT loader unpacks an obfuscated Lua script, which drops SmartLoader onto your machine. SmartLoader then establishes persistence and pulls down the real payload — typically StealC, an information stealer capable of harvesting browser passwords, crypto wallets, session tokens, and cloud credentials.
This Isn’t New, But It’s Different Now
Malicious repos on GitHub aren’t a new problem. Researchers at Straiker AI and Derp.ca had already flagged trojanized MCP servers distributing SmartLoader earlier this year. But what makes FakeGit different is the scale and the automation.
Seven thousand six hundred repos. That’s not a handful of bad actors manually uploading malware. This is an organized operation, likely AI-assisted, churning out fake repositories at a pace that human reviewers could never keep up with. And because GitHub’s trust model still relies heavily on community reporting and post-incident takedowns, these repos stay live long enough to rack up millions of downloads.
As of July 2026, the campaign has recorded more than 14 million downloads across GitHub Release assets in about 200 campaign repositories. Fourteen million. And that’s just the ones they’ve detected.
AgentBaiting: When Your AI Tool Becomes the Attack Vector
Here’s where it gets personal for anyone using AI coding assistants.
Island’s research team tested Claude Code, Google Gemini, and OpenAI ChatGPT, and found all three could be tricked into surfacing FakeGit repositories on their own. No malicious link needed. Just a prompt like “find me a free Claude cinematic prompt skill” or “give me a Walmart MCP server link.”
The AI agent searches, finds a FakeGit repo among the results, reads the convincing README, and presents the installation instructions to the user as if they’re legitimate. The user follows the steps — “download this ZIP, run this command” — and the malware deploys.
This is the evolution of social engineering. Instead of tricking a human into clicking a link, you trick the AI agent that the human trusts. The agent becomes an unwitting accomplice.
I wrote about a similar dynamic last week in my piece on the three AI coding tool security warnings, where researchers demonstrated that AI agents could be manipulated through planted data. AgentBaiting takes that concept and industrializes it. Seven thousand six hundred baited hooks, all sitting in GitHub’s search results, waiting for an agent to discover them.
Public Registries Make It Worse
What makes FakeGit particularly insidious is that it doesn’t just rely on GitHub search. The operators have listed more than 600 of their malicious repos on public MCP and AI skill registries like LobeHub, Glama, MCP.so, and MCP Market.
These registries are supposed to be curated catalogs of useful tools. Developers browse them to find MCP servers for their AI agents, skills for their coding assistants, and integrations for their workflows. A listing on one of these registries carries an implicit stamp of legitimacy — “someone vetted this.”
Except they didn’t. Or not well enough.
This is the same problem we’ve seen play out in npm, PyPI, and every other package registry. The difference is that MCP servers have a much wider blast radius. An MCP server doesn’t just add a library to your project. It can read your filesystem, access your databases, and execute commands on your machine — all with the permissions of the AI agent running it.
The Attack Chain, Simplified
If you’re wondering exactly how this works end-to-end, here’s the flow:
- The lure — A fake GitHub repo with a convincing name like “claude-cinematic-prompt-skill” or “walmart-mcp-server” appears in search results.
- The download — The README instructs users to download a ZIP file from the repo’s Releases section. 200 campaign repos have recorded 14 million downloads total.
- The loader — The ZIP contains a LuaJIT-based loader chain. An obfuscated Lua script unpacks and executes SmartLoader.
- The payload — SmartLoader establishes persistence and downloads StealC, which begins harvesting credentials, tokens, and sensitive data.
- The exfiltration — Stolen data is sent to attacker-controlled servers. The developer may not notice anything unusual for weeks.
And in the AgentBaiting variant, step one doesn’t even require the user to search. The AI agent does the discovery on its own.
The Wider Pattern: This Week in AI-Targeted Attacks
FakeGit didn’t emerge in a vacuum. This same week, researchers at Pillar Security published their “Week of Sandbox Escapes” series, demonstrating how Cursor, OpenAI’s Codex, Google’s Gemini CLI, and Antigravity could all be broken out of their sandboxes through a shared weakness: the files an agent writes inside the sandbox are trusted by tools running outside it. A prompt injection planted in a README or a dependency becomes a local command on the developer’s machine.
Then there’s the Agent Data Injection attack, where a single planted review on a product page can make an AI agent misclick or run attacker commands. And let’s not forget the Cursor RCE flaw from last week — open a repository in Cursor on Windows with a file named git.exe in the project root, and Cursor runs it with no approval dialog.
Each of these is a different vulnerability class. But they all share the same root cause: AI coding tools were built for convenience first, security second. The sandbox escapes work because the tool trusts files the agent writes. The Agent Data Injection works because the agent trusts the data it reads. FakeGit and AgentBaiting work because the developer trusts the repository their AI assistant recommends.
It’s a chain of trust, and every link is being tested right now.
What This Means for Developers
I’ve been thinking about this all day, and I keep coming back to the same uncomfortable conclusion: our trust model for open-source tooling is fundamentally broken when AI agents are in the loop.
As an ICT manager, I rely on AI coding tools daily. They make me faster, catch my blind spots, and help me explore solutions I wouldn’t have considered. But the same convenience that makes them valuable also makes them dangerous. If my coding assistant can be tricked into recommending a malicious package, then every member of my team using the same assistant is exposed to the same risk.
This is the supply chain security problem, but amplified for the AI era. The npm attack I covered a week ago and the Hugging Face breach from earlier today are variations on the same theme: attackers are going after the trust infrastructure that developers depend on.
Island’s researchers put it bluntly: “FakeGit did not need to breach anything. It published convincing repositories, borrowed real developers’ identities, spread its listings across public registries, and let discovery do the rest.”
What You Can Do Right Now
There’s no magic bullet here, but there are practical steps that make a real difference:
- Build a reviewed catalog. Maintain an internal allowlist of approved MCP servers, skills, and agent plugins. Don’t let your team install random tools from GitHub search results.
- Sandbox new tools. Before rolling out a new MCP server or AI skill across your team, evaluate it in an isolated environment. Watch what files it accesses and what network calls it makes.
- Verify the publisher. Check the profile’s history, the repo’s commit graph, and whether the project has real community engagement. Fake profiles tend to have shallow histories and no genuine interactions.
- Monitor agentic pathways. If your team uses AI coding agents, pay attention to what sources they’re pulling from. A prompt that returns a GitHub link you’ve never heard of deserves a second look.
- Use secret detection tools. Tools like HeimWall catch credentials before they leave your machine, which adds a safety net even if malware slips through.
I’m not saying stop using AI coding tools. Far from it. I’m saying we need to update our security practices for a world where the threat isn’t just a phishing email or a compromised npm package. It’s a convincing GitHub repo that your AI assistant finds for you, presents as legitimate, and walks you through installing.
The tools are getting smarter. The attackers are too. Our defenses need to keep pace.
What practices have you put in place to vet the AI tools and MCP servers your team uses? I’d love to hear what’s working — drop a comment or reach out.