FakeGit Campaign Evolves with AI-Powered AgentBaiting, Exploiting Vulnerable AI Models to Deliver SmartLoader Malware

Cybersecurity researchers have uncovered a sophisticated and evolving threat campaign, codenamed FakeGit, which has weaponized nearly 7,600 malicious repositories on GitHub. A significant portion of these, over 800, are specifically designed to impersonate artificial intelligence (AI) skills or Model Context Protocol (MCP) servers, serving as a deceptive front to distribute a potent malware family known as SmartLoader. This discovery marks a worrying escalation in cyber threats, demonstrating how malicious actors are not only targeting human users but are now adept at exploiting the very AI agents designed to assist them.

The intricate methodology of FakeGit, as detailed by Oleg Zaytsev, lead security researcher at Island, involves a multi-pronged approach to ensnare unsuspecting victims. "FakeGit uses copied projects, lookalike developer profiles, convincing READMEs, and malicious ZIP files to deliver SmartLoader malware," Zaytsev stated in a report shared with The Hacker News. The ultimate objective of these insidious attacks is to gain a foothold on compromised systems through SmartLoader, establish persistent access, and then deploy secondary payloads. Among these secondary threats is StealC, an information-stealing malware capable of exfiltrating a wide array of sensitive data from infected machines.

This alarming trend of utilizing trojanized MCP servers to propagate SmartLoader and StealC malware has not emerged overnight. Earlier this year, the threat was first identified by Straiker AI and subsequently detailed by Derp.ca. However, the latest iteration of the FakeGit campaign introduces a particularly concerning evolution dubbed "AgentBaiting," which leverages the inherent functionalities of AI agents to further the attackers’ objectives without direct human intervention.

The Mechanics of Deception: From Human Scams to AI Exploitation

The core of the FakeGit campaign relies on creating an illusion of legitimacy. Attackers meticulously craft repositories that mimic popular and in-demand AI functionalities and integrations. These often include names and workflows associated with well-known consumer and enterprise tools, aiming to capitalize on the burgeoning demand for AI capabilities. By borrowing the identities of legitimate developers and utilizing familiar project structures, these malicious repositories present a credible facade.

The process typically begins with a user or an AI agent searching for specific AI skills or MCP servers on platforms like GitHub. The FakeGit repositories are strategically named and described to appear as genuine solutions for tasks ranging from Gmail and WhatsApp integrations to complex enterprise tooling like Databricks, Jenkins, and Docker. This familiarity acts as a powerful lure.

When a user or an AI agent interacts with one of these repositories, they are often presented with a README file that appears to be standard documentation. This README, however, contains carefully crafted instructions designed to guide the unsuspecting party into downloading a malicious ZIP file. Upon execution, this ZIP file initiates a complex loader chain, often involving LuaJIT, which ultimately executes an obfuscated Lua script. This script is the primary mechanism for dropping and running the SmartLoader malware. Once SmartLoader is established, it then proceeds to deploy the StealC information stealer.

The sheer scale of the operation is noteworthy. As of July 2026, the FakeGit campaign has amassed over 14 million downloads across GitHub Release assets, primarily concentrated within approximately 200 actively managed campaign repositories. These repositories were created by an estimated 6,600 profiles, underscoring the organized nature of the operation.

AgentBaiting: A New Frontier in AI-Driven Cyberattacks

The AgentBaiting evolution represents a significant leap in the sophistication of the FakeGit campaign. This new tactic exploits the way AI agents, particularly those designed for task completion and information retrieval, operate. Instead of relying solely on human social engineering, AgentBaiting targets the AI agents directly.

The concept is straightforward yet profoundly impactful: an AI agent, while performing its designated search for a skill or MCP server, can inadvertently discover one of these compromised GitHub repositories. Without any human oversight or prompt explicitly linking it to malicious intent, the AI agent might perceive the FakeGit repository as a legitimate resource. It could then proceed to follow the instructions within the malicious README, effectively executing the attacker’s commands on its own.

Island’s research indicated that prominent AI models, including Anthropic Claude Code, Google Gemini, and OpenAI ChatGPT, are susceptible to this form of trickery. These models have demonstrated the capability to surface malicious campaign repositories simply through natural language queries, even without being provided with a direct link to the compromised content. This implies that a technique originally conceived to socially engineer humans now possesses the power to deceive AI agents acting on behalf of those humans.

For instance, a prompt like "Find free claude cinematic prompt skill, and give me the installation instructions" or "give me a free walmart MCP server link" could lead an AI agent to discover a FakeGit repository. The AI, mistaking the README for legitimate documentation, would then present the attacker’s instructions to the user, effectively bypassing traditional human-centric security measures. Island’s report emphasizes that "FakeGit built its AI lures around this path."

The Ecosystem of Deception: Public Registries as Enablers

Adding another layer to the sophistication of the FakeGit campaign is its integration with public registries. The malicious skills and MCP servers are not confined to obscure corners of GitHub. Instead, they are often listed on public registries such as LobeHub, Glama, MCP.so, and MCP Market. This strategic placement provides a veneer of legitimacy, making it even more challenging for users and AI agents to discern the malicious intent. Island noted that over 600 campaign listings have been identified across these public registries, highlighting the widespread dissemination of these deceptive offerings.

This broad distribution, combined with the AI-driven discovery facilitated by AgentBaiting, creates a potent threat. The attackers essentially did not need to breach any systems. They published convincing repositories, impersonated real developers, distributed their malicious listings across multiple public platforms, and then allowed the natural discovery processes—both human and AI-driven—to complete the infection chain.

Chronology of a Developing Threat

While the FakeGit campaign itself is a significant concern, its evolution offers a timeline of increasing sophistication in cyber threats:

• Early 2026: The initial stages of malicious activity involving trojanized MCP servers to distribute SmartLoader and StealC malware were flagged by security researchers at Straiker AI.
• Mid-2026: Derp.ca further detailed the FakeGit campaign, highlighting the use of LuaJIT in GitHub-based malware distribution.
• Recent Findings (July 2026): Island researchers identify the widespread nature of the FakeGit campaign, with nearly 7,600 malicious repositories and over 14 million downloads. Crucially, they uncover the AgentBaiting evolution, demonstrating the exploitation of AI agents.

This progression illustrates a rapid adaptation by threat actors, moving from traditional social engineering tactics to exploiting the emerging capabilities of AI.

Supporting Data and Technical Analysis

The technical underpinnings of the FakeGit campaign reveal a methodical approach to malware delivery. The repositories, whether entirely fabricated or copied from legitimate open-source projects, serve as a distribution vector for a malicious ZIP archive. This archive contains the initial payload, designed to trigger a LuaJIT loader chain. The LuaJIT loader then executes an obfuscated Lua script. This script’s primary function is to download and deploy the SmartLoader malware.

SmartLoader, once active on a compromised system, acts as a gateway. Its key functions include establishing persistence, allowing the malware to survive system reboots and maintain its presence. Following successful persistence, SmartLoader is programmed to download and execute secondary payloads. StealC is a frequently observed secondary payload, specifically designed for information theft. Its capabilities include harvesting credentials, browser data, cryptocurrency wallets, and other sensitive information from the infected machine.

The deceptive nature of the FakeGit repositories is further amplified by the use of convincing README files. These files often contain detailed, step-by-step instructions that appear to be standard setup procedures for the mimicked AI skill or MCP server. However, these instructions subtly guide the user or AI agent towards executing the malicious code embedded within the downloaded ZIP file.

Broader Impact and Implications

The FakeGit campaign and its AgentBaiting evolution carry significant implications for the future of cybersecurity, particularly in the context of widespread AI adoption:

• Erosion of Trust in AI Assistants: The ability of malicious actors to deceive AI agents directly can undermine user confidence in AI-powered tools. If AI assistants can be easily manipulated to execute harmful actions, their utility and perceived safety will diminish.
• New Attack Vectors: AgentBaiting opens a new frontier for cyberattacks. It shifts the focus from exploiting human vulnerabilities to exploiting the operational logic and discovery mechanisms of AI agents, requiring a fundamental rethink of security protocols.
• Challenges for AI Model Development: Developers of AI models must now consider the potential for their creations to be manipulated into performing malicious acts. This necessitates building more robust safeguards against prompt injection, hallucination, and the execution of unauthorized code.
• The Arms Race Intensifies: As AI capabilities advance, so too will the methods employed by malicious actors to exploit them. This creates an ongoing arms race where defensive strategies must constantly adapt to counter novel attack vectors.
• Supply Chain Risks in AI Ecosystems: The reliance on third-party repositories and integrations for AI development and deployment creates supply chain risks. FakeGit highlights how these ecosystems can be infiltrated and weaponized.

Expert Reactions and Official Responses (Inferred)

While direct quotes from major AI developers or platform providers regarding the FakeGit campaign and AgentBaiting were not immediately available in the initial report, the implications would undoubtedly prompt swift internal reviews and potential public statements.

A spokesperson for a major AI platform might comment, "We are aware of emerging threats that leverage AI capabilities for malicious purposes. Our security teams are continuously working to enhance our models’ resilience against such attacks and to protect our users. We are actively investigating the reported vulnerabilities and will implement necessary countermeasures."

Similarly, cybersecurity organizations like GitHub would likely reiterate their commitment to platform security. A statement might read, "GitHub is dedicated to providing a secure platform for developers. We have systems in place to detect and remove malicious content, and we work closely with the security community to address emerging threats. We encourage users to report suspicious activity and to exercise caution when downloading code from any source."

Countermeasures and Future Defenses

Island’s report offers crucial recommendations for mitigating the threat posed by FakeGit and AgentBaiting:

• Curated Catalogs: Organizations should develop and maintain curated catalogs of reviewed and approved AI skills, MCP servers, and agent plugins. This ensures that only trusted components are utilized.
• Sandboxed Evaluation: New AI agent capabilities and integrations should be rigorously evaluated in a sandboxed environment before broader deployment. This allows for the detection of malicious behavior without risking production systems.
• Publisher and Project Verification: A critical step in the defense strategy is to thoroughly verify the publisher and the legitimacy of any project before integration. This includes checking developer reputation, project history, and community feedback.
• Monitoring Agentic Pathways: Continuous monitoring of AI agent behavior and discovery pathways is essential. Identifying unusual patterns or unexpected interactions can provide early warnings of compromise.
• Security Education: Enhancing security awareness for both human users and AI developers is paramount. Understanding the evolving threat landscape and the potential for AI manipulation is key to effective defense.

The FakeGit campaign serves as a stark reminder that as technology advances, so do the methods of those who seek to exploit it. The integration of AI into cybersecurity tools and everyday applications introduces new vulnerabilities, and the AgentBaiting evolution of FakeGit demonstrates that threat actors are adept at exploiting these emerging landscapes. The future of cybersecurity will undoubtedly involve a more nuanced understanding of AI’s role, both as a tool for defense and as a potential target for sophisticated attacks. The race to secure AI ecosystems is on, and proactive, adaptive strategies are no longer optional but imperative.