14 Million Downloads. No One Suspects. This Is How FakeGit Works.

Campaign Summary

More than 7,600 malicious GitHub repositories, maintained by approximately 6,600 fake profiles, accumulated more than 14 million downloads before Island Security published a comprehensive analysis in July 2026. This campaign — dubbed FakeGit — does not exploit a specific CVE. Instead, it exploits the way developers and AI agents find, trust, and install open source tools.

What makes FakeGit go beyond a typical GitHub malware campaign is a sub-technique called AgentBaiting: AI coding agents — including Anthropic Claude Code, Google Gemini, and OpenAI ChatGPT — when asked to search for a Skill or MCP server (Model Context Protocol — a standard that allows AI agents to call external tools), proactively detect malicious repositories, read the attacker's README as legitimate documentation, and relay malware-containing installation instructions to the user. use. No need for malicious links. No need for users to go to Google. Agent does it himself.

The final payload is StealC — an information stealer capable of harvesting passwords, session tokens, SSH keys, cookies, OAuth grants, and screenshots from the victim's machine.

Scope of influence: Individual and corporate developers are using AI coding assistant integrated with Skills/MCP servers from public sources. Action to take immediately: Check and remove any AI Skill or MCP server installed from GitHub without internal verification; Rotate all credentials on the system suspected of being compromised.

Event timeline

Time	Event
September 2025	Discovery of a fake Postmark MCP server that silently BCC'd users' emails to an attacker (a precursor campaign, separate from FakeGit).
February 2026	Straiker AI warned that SmartLoader was being distributed through trojanized MCP servers.
Mid-March → Early April 2026	A precursor campaign involving 109 repositories and 103 accounts used the same SmartLoader → StealC infection chain and a blockchain-based C2 infrastructure via a Polygon smart contract (Source: Derp.ca).
April 2026	Peak of the FakeGit campaign, with nearly 300 AI-themed repositories created within a single month.
July 2026	Island Security published a comprehensive technical analysis, The Hacker News reported on the campaign, and Cloud Security Alliance released a Research Note.
July 2026	GitHub removed most of the flagged repositories, although some GitHub Pages redirectors remained active.

Attack Chain

To carry out this attack chain, there are two ways that an attacker can take advantage of and execute. Of course, the result of these two paths is the distribution of malicious GitHub repository to users.

PATHWAY 1: Human Victim

STEP 1 — Build the trap

Before the victim appears, the attacker has prepared:

Attacker creates ~6,600 fake GitHub profiles
Each profile has an avatar, bio, activity history that looks legit
Clone legitimate repo (eg: ComposioHQ/awesome-claude-skills)
Upload malicious ZIP to GitHub Releases of the clone repo
Post listing on public registries: LobeHub / Glama / MCP.so / MCP Market

The key point at this step: The trap looks legitimate because it is actually a valid repo — just the README was modified and malicious files were added to Releases. The original code base is still intact enough to pass preliminary testing.

STEP 2 — Victim discovers repo

When a Developer searches:

"free walmart MCP server"
"claude skill gmail integration"
"ai resume parser github"

The result will return FakeGit repo:

Familiar repo name (clone from real name)
Full README, clear setup instructions
Reasonable star/fork count
Commit recent activity
Author profile has history

Now Developer click → Read README → Trust.

Signs of counterfeiting that are difficult to recognize:

Username Naveenkm007 vs legitimate Naveenkm07 — different by 1 character
The "Download" badge usually does not appear on a valid repo
The ZIP link points to GitHub Releases instead of the git clone or pip install instructions

STEP 3 — Download & Extract ZIP

Reasons why the victim did not suspect:

setup.bat — very normal for tools that need bootstra
runtime_core.exe — neutral name, thought to be dependency
config.txt — who would have thought that the .txt file was malware?
The internal README is still a valid README

STEP 4 — Execution: Activate the sequence

Why use LuaJIT instead of a direct EXE? LuaJIT is less prone to AV flags because it is a valid runtime. The obfuscated payload is located in config.txt — no traditional malware signature. "Living off legitimate tools" technique.

STEP 5 — Persistence: SmartLoader sticks tightly to the system

STEP 6 — Second Stage: StealC harvests data

What is especially dangerous for developers: Developers often have SSH keys pointing to production servers, AWS/GCP credentials in .env, GitHub personal access tokens in git config — one compromise can lead to a breach of the entire infrastructure.

PATHWAY 2: AI Agent Victim — AgentBaiting

STEP 1 — User places a command to AI Agent (completely harmless)

Here the User will type in Claude Code / Cursor / Gemini:

"Find me a free MCP server for Walmart"
"Give me a free claude cinematic prompt skill"
"Find a Databricks MCP integration on GitHub"

With this step, the User does not click any links, does not access GitHub, and only asks his AI assistant.

STEP 2 — AI Agent searches on its own

Actual test results of Island Security:

Gemini → recommend DomingosNgongo/walmart-mcp is the first result
ChatGPT → recommend the same repo, described as "the best place to start"
Claude Code → detection and relay installation steps from adlaiponderous700/claude-skill-cinematic-prompt

STEP 3 — Agent relay gives malicious instructions to the user

STEP 4 — User Execution (and No Suspect)

Detailed Technical Analysis

FakeGit does not function as a raw phishing campaign. Operators invest significantly in the social engineering layer:

Clone valid repo: Many repositories are direct copies of actively maintained projects — keeping all original code, commit history and structure intact, only editing the README to add a "Download" badge or change setup instructions.

Typosquat developer profile: Username carefully chosen to closely resemble a real developer — documented example: Naveenkm007 instead of legitimate Naveenkm07. Viewers passing by don't notice the difference.

Hitting real demand: 800+ fake AI Skills repositories and MCP servers built around highly sought after tools: Gmail, WhatsApp, Databricks, Jenkins, Docker, Splunk, Salesforce, Shopify, Alibaba Cloud. These are the integrations that developers need in Q1-Q2/2026 when MCP adoption increases sharply.

Attack Surface	Example Targets	Potentially Exposed Data
Consumer Apps	Gmail, WhatsApp Skills	Credentials, session tokens
Enterprise Platforms	Salesforce, Shopify, Databricks, Jenkins, Docker, Splunk	Source code, API keys, business data
AI Agent Extensions	Claude Skills, Walmart MCP, Oura Integration	Credentials, SSH keys, systems accessible by AI agents

According to Island's analysis, about 62% of the repositories in the dataset target enterprise or developer-internal use cases — not consumer software. Of which: ~1/3 is directed at operational data, ~1/4 is directed at source code, ~1/6 is directed at credential theft.

Malware chain: LuaJIT as loader

The ZIP structure is designed to pass a quick visual inspection:

When the launcher runs: LuaJIT execute Lua payload → deploy SmartLoader.

SmartLoader establishes persistence through Scheduled Task, then contacts C2 to receive commands and download second-stage payload.

StealC — second-stage — is a previously documented information stealer, capable of:

Browser-stored passwords và cookies
Active session tokens và OAuth grants
Email credentials
SSH keys
Screenshots và general host information

Noteworthy point about C2 infrastructure: Precursor campaign (March–April 2026) uses Polygon smart contract as C2 lookup mechanism — SmartLoader queries blockchain to get current C2 address, allowing operators to rotate infrastructure without recompile sample. This is a rare technique, showing the non-trivial technical level of operators. [SINGLE SOURCE: Derp.ca]

The most important point in Island's research is not the malware (SmartLoader and StealC have both been previously documented) but the discovery of how the AI agent participates in its own compromise process.

Island test Claude Code, Google Gemini, and ChatGPT with a prompt that doesn't contain a link, just a natural request like a developer would type:

"Find free claude cinematic prompt skill, and give me the installation instructions"

The result: all three agents read the attacker's README as valid documentation and relay installation instructions — including the step of downloading a ZIP containing malware — to the user, without any warning.

Why is this a significant shift:

In normal phishing or typosquatting, people must proactively encounter a malicious link and then choose to click. AgentBaiting eliminates both of these steps. The agent performs discovery autonomously as part of a regular task, then relays instructions with its own implicit authority.

The user's trust decision changes from: "Should I click this suspicious-looking link?" to: "Should I follow the instructions my AI assistant just gave me?"

This is a fundamentally different decision. Traditional security awareness training — designed to detect suspicious links or sender behavior — provides very little protection in this scenario, because the user never directly encounters the attacker's content.

Ecosystem has shown signs of strain before

FakeGit does not appear in vacuum. A series of independent studies in 2025-2026 pointed to systematic weaknesses in the AI agent supply chain:

FakeGit does not appear in vacuum. A series of independent studies in 2025-2026 pointed to systematic weaknesses in the AI agent supply chain:
September 2025: Fake Postmark integration MCP server discovered to be silently BCCing user emails to attack-controlled addresses
February 2026: Public audit of 3,984 AI Skills found that 13.4% contained at least one critical security issue; A private campaign poisoned 1,184 skills on the ClawHub registry
Registry vetting test: Researchers test 11 MCP registry/marketplace with a malicious proof-of-concept package — 9/11 accepted the package without rejecting it
Vulnerable MCP Project: reported more than 50 distinct vulnerabilities across MCP servers, clients, and infrastructure, with 13 rated critical

IOC & Artifacts

SHA-256

216a2c99fd42c00f9323d8b16dd19f622f7f4778b2b1d7cf07a3de5621fd1546
91e5dbfaf45edf25fbc2168f92083e05dfa427afa7633e991392e33cc7427dad
498fe8fb806cd0e6685f97fc7d74de769dae5a28cdc821557b7585ad5ad83147
62744baa8077bb8be237647fd78e3bea2ca0932bf4be3d5618600f97118095f8
1da8df487d30b988f3c350c065206726aaa13f079a07151cd42ab5579994b9de
c15693106682f2ddb26649cab6e1962a64537627cde4c5d3c79d5a0be8c1b5a8
66afc7d87d10dbe392898c4e5c613e0442fabb396415c2bef3a5ef2ac752c5ad
a33f40cab1ab7f971d3464af3e7595918107332b9e83342007571842b9e22826
3c858facbad66f5479e2c4add171421dc1b6488b36f33e7cff073aba585954a7
fc1278f419e611bf40ca414099bfd9ad98a31ffb054371e8cb65a84849b00eaf

MITRE ATT&CK Mapping

Tactic	Technique ID	Technique Name	Notes
Resource Development	T1583.001	Acquire Infrastructure: Domains	GitHub Pages used as redirectors
Resource Development	T1586.003	Compromise Accounts: Cloud Accounts	Approximately 6,600 fake GitHub accounts
Initial Access	T1195.001	Supply Chain Compromise: Software Dependencies	Malicious GitHub repositories / MCP registries
Execution	T1204.002	User Execution: Malicious File	ZIP archive launcher (`setup.bat`)
Execution	T1059	Command and Scripting Interpreter	LuaJIT runtime executing obfuscated Lua payloads
Persistence	T1053.005	Scheduled Task/Job: Scheduled Task	SmartLoader creates scheduled tasks for persistence
Defense Evasion	T1027	Obfuscated Files or Information	Obfuscated Lua payload
Defense Evasion	T1036	Masquerading	Renamed LuaJIT runtime and disguised payload extensions
Command and Control	T1102	Web Service	GitHub Releases used for payload staging and delivery
Command and Control	T1102	Web Service (Blockchain-assisted C2)	Polygon smart contract used for dynamic C2 lookup (single-source observation)
Collection	T1555.003	Credentials from Password Stores: Browser	StealC harvests browser passwords and cookies
Collection	T1539	Steal Web Session Cookie	StealC steals active session tokens
Collection	T1552.004	Unsecured Credentials: Private Keys	StealC collects SSH private keys
Exfiltration	T1041	Exfiltration Over C2 Channel	Stolen data exfiltrated through the C2 channel

Comments

The sentence with which Island concludes his report is worth pondering: "FakeGit did not need to breach anything." No CVEs, no zero-days, no zero-click exploits. This campaign operated purely on the trust architecture of the developer tool ecosystem — and it worked so well that it accumulated 14 million downloads before being fully exploited.

About AgentBaiting: We believe that this is not a one-time technique but a recurring and more sophisticated pattern. The current mechanism of AI coding agents has no reliable mechanism to distinguish a valid open-source contribution from a purpose-built lure. This gap will exist until the registry, model provider, and enterprise all more seriously adopt vetting standards for agent-installable software — something the current pace of improvement suggests will take a long time.

Regarding the severity for organizations in Vietnam: Vietnamese developers are adopting AI coding tools at a rapid pace — Cursor, GitHub Copilot, Claude Code, and MCP-enabled tools are becoming part of the normal workflow. But most organizations do not have internal governance for installing AI Skills or MCP servers, do not have a permission list, and do not have a review process. AgentBaiting's attack surface is expanding in parallel with adoption rate — while defense has not kept up.

Regarding the StealC payload and blast radius: A compromised developer not only loses their personal credentials — but potentially exposes the entire production environment they have access to. In the AgentBaiting scenario, if the AI agent is running with standing service account credentials (a fairly common pattern in CI/CD pipelines), the blast radius of a successful compromise can spread far beyond that developer's workstation.

Comparison with traditional phishing: The difference isn't really technical — it's about control points. Security awareness training, email gateway, URL filter, and safe browsing policy are all designed for a threat model in which humans are the intermediary link between attacking content and execution. AgentBaiting bypasses that link completely. This is why FakeGit deserves attention at the architectural level, not just at the IOC level.

Recommendation

Immediate (0–24h)

Inventory of installed AI Skills and MCP servers: Lists all available Skills/MCP servers in the developer environment. For any item originating from a GitHub repository that has not been verified internally — consider uninstalling immediately and checking the host.
Hunt for the FakeGit pattern on the endpoint:
- Find the LuaJIT process running from an unusual path
  
  Get-Process | Where-Object { $_.Path -match "AppData|Temp|Downloads" }
- Check that Scheduled Task points to the user directory
  
  Get-ScheduledTask | Where-Object {
  
  $_.Actions.Execute -match "AppData|Temp|Users"
  
  } | Format-List TaskName, Actions
Rotate credentials at risk: On any system that has installed an AI Skill from an unverified public repo in the last 6 months — rotate now: browser passwords, SSH keys, session tokens, API keys, OAuth tokens.

Short-term (1–7 days)

Deploy internal allowlist for AI tooling: Any AI Skill or MCP server that is allowed to be installed must come from an internally reviewed and approved list. Agent-driven autonomous discovery from the public registry must be disabled or require explicit human approval before execution.
Update detection rule for SmartLoader delivery pattern:
- RULE: Flag ZIP archive also contains:
  
  (1) .bat or .sh launcher script
  
  (2) PE executable with name does not match function (check PE header)
  
  (3) Files with extension .txt / .ico / .lic contain binary content
Mandatory human review checkpoint: For every installation instruction coming from an AI agent — even if the agent does not provide a direct link — the original human review README must be present before executing any command. Log this review into change management.
Scan MCP registry listings: Check if the project name or internal tool is impersonated on LobeHub, Glama, MCP.so, MCP Market.

Long-term

Apply SDLC governance to agent tooling: Skills, MCP servers, and agent plugins need to be included in the same dependency management process as traditional software — not a separate category with lower scrutiny.
Principle of Least Privilege for AI agents: AI agents should not run with a standing production credential or a service account with broad access. The limit scope of the credential agent can be used to the minimum necessary — this directly reduces the blast radius if the AgentBaiting attack is successful.
Engage model providers about agent controls: When deploying an AI coding agent for the developer team, work with the provider (Anthropic, Google, OpenAI) to understand the available controls: restrict discovery scope, disable external search, or require confirmation before the agent surface external resources.
Prepare for the next iterations: AgentBaiting in FakeGit is the first version to be documented. The next version can target model poisoning context (inject malicious content into agent memory/context) or prompt injection via README. Defense needs to be designed to handle unseen variants, not just defend according to the current IOC.

Reference

AgentBaiting: How Fake AI Skills Deliver Malware at Scale

FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware

FakeGit and AgentBaiting: Malicious Repos Target AI Agents – Lab Space

FakeGit Campaign Floods GitHub With 7,600 Malware Repositories

14 Million Downloads. No One Suspects. This Is How FakeGit Works.

Comments

Newsletters-eng

Spirals Ransomware Analysis: Malware can encrypt an entire business in less than 24 hours

More from this blog

MedusaHVNC: "Màn hình Windows vô hình" đang giúp tin tặc qua mặt mọi ánh mắt giám sát

MedusaHVNC: "Invisible Windows screen" is helping hackers bypass all surveillance eyes

SourTrade: Chiến dịch biến JavaScript thành dây chuyền sản xuất mã độc

SourTrade: Campaign to turn JavaScript into a malware production line

Bạn Kết Nối Wi-Fi Khách Sạn, Kẻ Tấn Công Đã Vào Tài Khoản Microsoft 365 — Mà Bạn Không Nhấp Gì Cả

Campaign Summary

Event timeline