Researchers from Island have identified a large-scale campaign dubbed FakeGit: according to their data, around 7,600 malicious repositories on GitHub, created by roughly 6,600 profiles, are distributing the SmartLoader malware. More than 800 of these repositories masquerade as skills for AI systems or servers for the Model Context Protocol (MCP). The technique known as AgentBaiting is particularly dangerous — AI agents such as Claude Code, Gemini, and ChatGPT, according to the researchers, can independently discover malicious repositories and pass the attackers’ instructions to the user. Organizations that use AI agents and MCP servers should immediately review their procedures for vetting external plugins and skills.
Attack mechanism: from fake repository to data theft
According to the researchers, the FakeGit campaign is built on platform-level social engineering. The attackers create repositories that are either entirely fabricated or cloned from legitimate projects. Each repository is equipped with a plausible README file, a developer profile imitating a real author, and a malicious ZIP archive in the releases section.
The reported infection chain looks as follows:
- The victim (a human or an AI agent) discovers a repository masquerading as a useful tool
- The README directs them to download a ZIP archive from the GitHub Releases section
- The archive launches a LuaJIT-based download chain — an obfuscated Lua script activates SmartLoader
- SmartLoader establishes persistence on the system and delivers a secondary payload — the StealC infostealer
- StealC collects a wide range of data from the compromised system
The fake repositories imitate both consumer and enterprise tools — according to Island, these include integrations with Gmail and WhatsApp, as well as tools for Databricks, Jenkins, and Docker. This broadens the attack surface from individual developers to corporate teams.
AgentBaiting: when an AI agent becomes an attack vector
The most alarming aspect of FakeGit is the technique Island calls AgentBaiting. The core idea is that an AI agent tasked by a user with finding a skill or an MCP server can independently discover a malicious repository, treat its README as legitimate documentation, and pass the attacker’s instructions to the user — without any human involvement in the discovery process.
In Island’s tests, the Anthropic Claude Code, Google Gemini, and OpenAI ChatGPT models were susceptible to this technique — they surfaced malicious campaign repositories in response to queries even when the user did not provide a direct link. Prompts such as “Find free claude cinematic prompt skill” or “give me a free walmart MCP server link” were sufficient.
Important note: the claims about the susceptibility of specific AI models are based on tests conducted by a single research source and have not yet been independently confirmed by Anthropic, Google, or OpenAI.
The use of trojanized MCP servers to distribute SmartLoader and StealC was previously observed by Straiker AI and later confirmed by independent research from Derp.ca. AgentBaiting represents an evolution of this campaign, in which a social-engineering technique originally aimed at humans has proven just as effective against autonomous AI agents.
Scale of distribution via public registries
The threat is not limited to GitHub. According to the researchers, more than 600 malicious listings tied to the campaign were found in public registries of MCP servers and skills, including LobeHub, Glama, MCP.so, and MCP Market. Being listed in these catalogs gives the fake tools an appearance of legitimacy and significantly increases the likelihood that they will be discovered by both humans and AI agents.
As Island emphasized: “FakeGit didn’t need to hack anything. The campaign published convincing repositories, borrowed the identities of real developers, distributed listings through public registries, and let discovery mechanisms do the rest.”
Impact assessment
The FakeGit campaign affects several categories of potential victims:
- Developers and DevOps engineers looking for MCP servers and integrations for enterprise tools (Jenkins, Docker, Databricks)
- AI assistant users who delegate plugin discovery and installation to agents
- Organizations that implement agent-based workflows without properly vetting external dependencies
The consequences of compromise include theft of credentials, access tokens, and other sensitive information via StealC, as well as potential long-term footholds in corporate infrastructure via SmartLoader.
Practical recommendations
- Create an internal catalog of vetted skills, MCP servers, and agent plugins — do not rely on public registries as your sole trust source
- Test new agent capabilities in an isolated environment (sandbox) before deploying them into production
- Verify the publisher and project: check commit history, account age, whether the author has other projects, and whether the profile matches a real developer
- Monitor agent execution paths: log and analyze which external resources your AI agents discover and recommend
- Block automatic execution of instructions from unverified README files — require explicit user confirmation before running installation commands
- Check for indicators of compromise: look for LuaJIT processes that are atypical for your environment, and for network connections characteristic of StealC
The FakeGit campaign highlights a fundamental problem: the MCP server and AI skill ecosystem is growing faster than the mechanisms available to verify it. Organizations that use AI agents in their workflows need to immediately introduce mandatory sandbox testing for external plugins and skills and restrict agents’ ability to autonomously download and execute code from untrusted sources — it is precisely this gap between discovery and execution that AgentBaiting exploits.
