Researchers have uncovered a large-scale campaign called FakeGit that has planted roughly 7,600 malicious repositories on GitHub to distribute SmartLoader and StealC malware. The repositories have collectively generated more than 14 million download events, according to researchers at enterprise browser platform Island.

More than 800 of the repositories impersonate AI skills or Model Context Protocol (MCP) servers, and over 600 of them appear in public AI registries and catalogs. Researchers call this technique “agentbaiting,” since it is designed specifically to increase visibility to AI coding agents and developers searching for AI tools, rather than just human users browsing GitHub directly.

Origins and Growth

Island researchers say FakeGit is a continuation of an earlier operation that distributed Lumma Stealer, previously attributed by Trend Micro to a threat actor tracked as Water Kurita. The AI-focused pivot reportedly began in March and peaked in April with the creation of roughly 300 AI-themed repositories. The campaign has since expanded to more than 1,400 repositories tied to AI tools, agents, and workflows, all ultimately linking to SmartLoader or StealC.

How the Lure Works

Many repositories impersonate well-known consumer and enterprise products, including Gmail, WhatsApp, Databricks, Jenkins, and Docker. They include fabricated star and fork counts, copied project descriptions, and borrowed developer account names to appear legitimate. Their README files direct visitors to download ZIP archives disguised as installers or releases, which actually contain Lua payloads that trigger SmartLoader.

Once active, SmartLoader establishes persistence via scheduled tasks, retrieves its command-and-control address through a Polygon smart contract, and pulls down additional encrypted stages hosted on GitHub before ultimately deploying the StealC information stealer.

AI Agents Fooled Too

In testing, Island found that ChatGPT, Gemini, and Claude surfaced malicious repositories when prompted with related tasks, and in some cases relayed installation instructions to users. In limited controlled tests, Claude Code went as far as cloning a malicious repository and downloading malicious files, though it later flagged suspicious indicators and halted before execution. Researchers caution the tests were not designed to measure a reliable detection rate.

Listings tied to the campaign were also found on public registries including LobeHub, Glama, MCP.so, and MCP Market, suggesting the operation has already infiltrated parts of the AI tooling ecosystem. It remains unclear whether these listings were submitted manually or indexed automatically.

Recommendations

Island notes that the 14 million download figure reflects GitHub’s public counters, which include repeated requests and automated activity, and should not be read as a confirmed infection count. The firm recommends organizations maintain approved catalogs of skills and MCP servers, test new capabilities in isolated environments, verify publishers independently, and rotate all secrets immediately in environments where SmartLoader execution is suspected.