FakeGit campaign uses 7,600 repos to push SmartLoader malware

A massive malware distribution campaign dubbed FakeGit is leveraging over 7,600 malicious GitHub repositories to push SmartLoader and StealC malware, racking up more than 14 million cumulative downloads. Among these, more than 800 repositories masqueraded as AI skills or MCP servers, appearing over 600 times in public AI registries and catalogs. This tactic, which researchers call AgentBaiting, dramatically increases the odds that both AI agents and human developers will stumble upon the malicious code.

This operation appears to be a continuation of an older campaign that distributed Lumma Stealer, previously attributed to a threat actor tracked as Water Kurita by Trend Micro researchers. According to analysts at the enterprise browser platform Island, the AI-focused push began in March and peaked in April, when 300 new GitHub repositories related to AI tools were created. The campaign has since ballooned to more than 1,400 repositories tied to AI tools, agents, and workflows, all linking back to SmartLoader or StealC payloads.

Many of these repositories impersonate well-known consumer and enterprise tools such as Gmail, WhatsApp, Databricks, Jenkins, and Docker. They come equipped with convincing documentation, fabricated star and fork counts, copied project descriptions, and even real developer account names to build credibility. The README files direct visitors to download ZIP archives that appear to be installers or project releases but are actually disguised Lua payloads that trigger SmartLoader.

Once SmartLoader gains a foothold, it establishes persistence through scheduled tasks, retrieves its command-and-control (C2) address via a Polygon smart contract, and downloads additional encrypted stages from GitHub. The final payload is the StealC information stealer, designed to exfiltrate sensitive data.

Island researchers describe AgentBaiting as an emerging technique specifically engineered to make malicious repositories more visible to AI agents. In a typical scenario, an AI agent parsing the README contents as legitimate documentation could recommend the repository or ZIP file to a human operator. In controlled tests, Island found that ChatGPT, Gemini, and Claude surfaced various malicious repositories when prompted with related tasks, and sometimes even relayed installation instructions.

The researchers identified more than 600 listings in public registries and catalogs for skills and MCP servers linked to the FakeGit campaign. These appeared on platforms including LobeHub, Glama, MCP.so, and MCP Market, indicating the operation has already penetrated the ecosystem and poisoned public resources. While it remains unclear whether these listings were submitted manually or indexed automatically, their presence made the repositories easier to discover and added an air of legitimacy.

In limited, controlled testing, Island researchers told BleepingComputer that Claude Code cloned malicious repositories and downloaded the malicious files onto the test machine. However, the agent subsequently detected suspicious indicators and stopped before execution. These tests were not designed to establish a detection rate, so they cannot provide conclusive results on whether coding agents can consistently recognize the danger during the execution stage.

Regarding the broader impact, GitHub’s public download counters for 335 unique Release assets across 211 FakeGit repositories recorded 14,084,688 cumulative download events. Oleg Zaytsev, Lead Security Researcher at Island, clarified that this figure includes repeated requests and automated activity, so it should not be interpreted as actual infections.

Island recommends that organizations maintain approved catalogs of skills and MCP servers, test new capabilities in isolated environments, and independently verify publishers and repositories. Where SmartLoader execution is suspected, all secrets on impacted environments should be rotated immediately.