Cybersecurity researchers have discovered nearly 7,600 malicious GitHub repositories, out of which more than 800 pose as artificial intelligence (AI) skills or Model Context Protocol (MCP) servers to deliver a malware family known as SmartLoader as part of an ongoing campaign codenamed FakeGit.
"FakeGit uses copied projects, lookalike developer profiles, convincing READMEs, and malicious ZIP files to deliver SmartLoader malware," Oleg Zaytsev, lead security researcher at Island, said in a report shared with The Hacker News.
The end goal of these attacks is to leverage the access afforded by SmartLoader to establish persistence and push secondary payloads, such as StealC, an information stealer capable of harvesting a wide range of data from compromised systems.
It's worth mentioning here that the use of trojanized MCP servers to distribute SmartLoader and StealC was flagged earlier this year by Straiker AI and subsequently by Derp.ca. But a concerning aspect of FakeGit is an AI-powered evolution dubbed AgentBaiting.
This occurs when an AI agent searching for a skill or an MCP server ends up inadvertently discovering one of these bogus GitHub repositories, causing it to do the attacker's bidding on its own without any intervention from a human user.
Island said its tests revealed Anthropic Claude Code, Google Gemini, and OpenAI ChatGPT to be susceptible to this trickery, allowing the models to surface malicious campaign repositories without even being shown a link. In other words, a technique set up with an original intent to socially engineer humans now has the capability to equally deceive an AI agent acting on their behalf.
Of the 7,600 malicious GitHub repositories created by about 6,600 profiles, 800 posed as Skills or MCP servers for individual and enterprise use, from Gmail and WhatsApp integrations to Databricks, Jenkins, and Docker tooling. As of July 2026, the FakeGit operation has recorded more than 14 million downloads across GitHub Release assets in about 200 campaign repositories.
"The repositories were designed to meet demand already forming around AI capabilities, borrowing the names and workflows of familiar consumer and enterprise tools," Zaytsev explained. "That familiarity gave the malicious ZIP files a credible reason to be downloaded, while the README guided users or agents from what appeared to be routine setup into the SmartLoader attack chain."