# 14 Million Downloads. No One Suspects. This Is How FakeGit Works. ## Campaign Summary More than 7,600 malicious GitHub repositories, maintained by approximately 6,600 fake profiles, accumulated more than 14 million downloads before Island Security published a comprehensive analysis in July 2026. This campaign — dubbed FakeGit — does not exploit a specific CVE. Instead, it exploits the way developers and AI agents find, trust, and install open source tools. What makes FakeGit go beyond a typical GitHub malware campaign is a sub-technique called AgentBaiting: AI coding agents — including Anthropic Claude Code, Google Gemini, and OpenAI ChatGPT — when asked to search for a Skill or MCP server (Model Context Protocol — a standard that allows AI agents to call external tools), proactively detect malicious repositories, read the attacker's README as legitimate documentation, and relay malware-containing installation instructions to the user. use. No need for malicious links. No need for users to go to Google. Agent does it himself. The final payload is StealC — an information stealer capable of harvesting passwords, session tokens, SSH keys, cookies, OAuth grants, and screenshots from the victim's machine. ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/f14ea253-97fd-4014-a08c-7364f53354e9.png align="center") Scope of influence: Individual and corporate developers are using AI coding assistant integrated with Skills/MCP servers from public sources. Action to take immediately: Check and remove any AI Skill or MCP server installed from GitHub without internal verification; Rotate all credentials on the system suspected of being compromised. ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/9f061132-83dd-446d-b755-aac5b095ca7d.png align="center") ## Event timeline | Time | Event | | --- | --- | | **September 2025** | Discovery of a fake Postmark MCP server that silently BCC'd users' emails to an attacker (a precursor campaign, separate from FakeGit). | | **February 2026** | Straiker AI warned that **SmartLoader** was being distributed through trojanized MCP servers. | | **Mid-March → Early April 2026** | A precursor campaign involving **109 repositories** and **103 accounts** used the same **SmartLoader → StealC** infection chain and a blockchain-based C2 infrastructure via a **Polygon smart contract** (Source: Derp.ca). | | **April 2026** | Peak of the **FakeGit** campaign, with nearly **300 AI-themed repositories** created within a single month. | | **July 2026** | Island Security published a comprehensive technical analysis, The Hacker News reported on the campaign, and Cloud Security Alliance released a Research Note. | | **July 2026** | GitHub removed most of the flagged repositories, although some GitHub Pages redirectors remained active. | ## Attack Chain To carry out this attack chain, there are two ways that an attacker can take advantage of and execute. Of course, the result of these two paths is the distribution of malicious GitHub repository to users. ### PATHWAY 1: Human Victim STEP 1 — Build the trap Before the victim appears, the attacker has prepared: * Attacker creates ~6,600 fake GitHub profiles * Each profile has an avatar, bio, activity history that looks legit * Clone legitimate repo (eg: ComposioHQ/awesome-claude-skills) * Upload malicious ZIP to GitHub Releases of the clone repo * Post listing on public registries: LobeHub / Glama / MCP.so / MCP Market ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/72ac8800-9e35-4a58-9aff-f9012f4ba749.png align="center") The key point at this step: The trap looks legitimate because it is actually a valid repo — just the README was modified and malicious files were added to Releases. The original code base is still intact enough to pass preliminary testing. ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/953a9220-9a1a-4c38-b75e-4c88652147df.png align="center") STEP 2 — Victim discovers repo ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/065f983a-f7e5-43e0-88d9-687d813a9121.png align="center") When a Developer searches: * "free walmart MCP server" * "claude skill gmail integration" * "ai resume parser github" The result will return FakeGit repo: * Familiar repo name (clone from real name) * Full README, clear setup instructions * Reasonable star/fork count * Commit recent activity * Author profile has history Now Developer click → Read README → Trust. Signs of counterfeiting that are difficult to recognize: * Username Naveenkm007 vs legitimate Naveenkm07 — different by 1 character * The "Download" badge usually does not appear on a valid repo * The ZIP link points to GitHub Releases instead of the git clone or pip install instructions STEP 3 — Download & Extract ZIP ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/93126a07-d8b4-4347-908d-96d493064e94.png align="center") Reasons why the victim did not suspect: * setup.bat — very normal for tools that need bootstra * runtime\_core.exe — neutral name, thought to be dependency * config.txt — who would have thought that the .txt file was malware? * The internal README is still a valid README STEP 4 — Execution: Activate the sequence ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/63c51c44-215c-464b-beac-903213a4487d.png align="center") Why use LuaJIT instead of a direct EXE? LuaJIT is less prone to AV flags because it is a valid runtime. The obfuscated payload is located in config.txt — no traditional malware signature. "Living off legitimate tools" technique. STEP 5 — Persistence: SmartLoader sticks tightly to the system ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/36565538-b2d7-4ef4-a731-a66c5d25a584.png align="center") STEP 6 — Second Stage: StealC harvests data ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/9fc05d1e-7e21-4d80-99c6-f998ef7aa86c.png align="center") What is especially dangerous for developers: Developers often have SSH keys pointing to production servers, AWS/GCP credentials in .env, GitHub personal access tokens in git config — one compromise can lead to a breach of the entire infrastructure. ### PATHWAY 2: AI Agent Victim — AgentBaiting STEP 1 — User places a command to AI Agent (completely harmless) Here the User will type in Claude Code / Cursor / Gemini: * "Find me a free MCP server for Walmart" * "Give me a free claude cinematic prompt skill" * "Find a Databricks MCP integration on GitHub" With this step, the User does not click any links, does not access GitHub, and only asks his AI assistant. STEP 2 — AI Agent searches on its own ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/b21144f4-2455-4c8b-9489-372396bceba0.png align="center") Actual test results of Island Security: * Gemini → recommend DomingosNgongo/walmart-mcp is the first result * ChatGPT → recommend the same repo, described as "the best place to start" * Claude Code → detection and relay installation steps from adlaiponderous700/claude-skill-cinematic-prompt STEP 3 — Agent relay gives malicious instructions to the user ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/7cbcdcf6-eb2d-447c-818b-2be6e82a0efd.png align="center") STEP 4 — User Execution (and No Suspect) ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/0cfcf7fb-4653-42c3-bb47-5555199b04c0.png align="center") ## Detailed Technical Analysis ### Detailed Technical Analysis FakeGit does not function as a raw phishing campaign. Operators invest significantly in the social engineering layer: Clone valid repo: Many repositories are direct copies of actively maintained projects — keeping all original code, commit history and structure intact, only editing the README to add a "Download" badge or change setup instructions. Typosquat developer profile: Username carefully chosen to closely resemble a real developer — documented example: Naveenkm007 instead of legitimate Naveenkm07. Viewers passing by don't notice the difference. Hitting real demand: 800+ fake AI Skills repositories and MCP servers built around highly sought after tools: Gmail, WhatsApp, Databricks, Jenkins, Docker, Splunk, Salesforce, Shopify, Alibaba Cloud. These are the integrations that developers need in Q1-Q2/2026 when MCP adoption increases sharply. | **Attack Surface** | **Example Targets** | **Potentially Exposed Data** | | --- | --- | --- | | Consumer Apps | Gmail, WhatsApp Skills | Credentials, session tokens | | Enterprise Platforms | Salesforce, Shopify, Databricks, Jenkins, Docker, Splunk | Source code, API keys, business data | | AI Agent Extensions | Claude Skills, Walmart MCP, Oura Integration | Credentials, SSH keys, systems accessible by AI agents | According to Island's analysis, about 62% of the repositories in the dataset target enterprise or developer-internal use cases — not consumer software. Of which: ~1/3 is directed at operational data, ~1/4 is directed at source code, ~1/6 is directed at credential theft. ### Malware chain: LuaJIT as loader The ZIP structure is designed to pass a quick visual inspection: ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/3636f95c-1e17-43db-91db-f71cf69061ea.png align="center") When the launcher runs: LuaJIT execute Lua payload → deploy SmartLoader. SmartLoader establishes persistence through Scheduled Task, then contacts C2 to receive commands and download second-stage payload. StealC — second-stage — is a previously documented information stealer, capable of: * Browser-stored passwords và cookies * Active session tokens và OAuth grants * Email credentials * SSH keys * Screenshots và general host information Noteworthy point about C2 infrastructure: Precursor campaign (March–April 2026) uses Polygon smart contract as C2 lookup mechanism — SmartLoader queries blockchain to get current C2 address, allowing operators to rotate infrastructure without recompile sample. This is a rare technique, showing the non-trivial technical level of operators. \[SINGLE SOURCE: Derp.ca\] ### AgentBaiting — paradigm shift in social engineering The most important point in Island's research is not the malware (SmartLoader and StealC have both been previously documented) but the discovery of how the AI agent participates in its own compromise process. Island test Claude Code, Google Gemini, and ChatGPT with a prompt that doesn't contain a link, just a natural request like a developer would type: > "Find free claude cinematic prompt skill, and give me the installation instructions" The result: all three agents read the attacker's README as valid documentation and relay installation instructions — including the step of downloading a ZIP containing malware — to the user, without any warning. Why is this a significant shift: In normal phishing or typosquatting, people must proactively encounter a malicious link and then choose to click. AgentBaiting eliminates both of these steps. The agent performs discovery autonomously as part of a regular task, then relays instructions with its own implicit authority. The user's trust decision changes from: "Should I click this suspicious-looking link?" to: "Should I follow the instructions my AI assistant just gave me?" This is a fundamentally different decision. Traditional security awareness training — designed to detect suspicious links or sender behavior — provides very little protection in this scenario, because the user never directly encounters the attacker's content. ### Ecosystem has shown signs of strain before FakeGit does not appear in vacuum. A series of independent studies in 2025-2026 pointed to systematic weaknesses in the AI agent supply chain: * FakeGit does not appear in vacuum. A series of independent studies in 2025-2026 pointed to systematic weaknesses in the AI agent supply chain: * September 2025: Fake Postmark integration MCP server discovered to be silently BCCing user emails to attack-controlled addresses * February 2026: Public audit of 3,984 AI Skills found that 13.4% contained at least one critical security issue; A private campaign poisoned 1,184 skills on the ClawHub registry * Registry vetting test: Researchers test 11 MCP registry/marketplace with a malicious proof-of-concept package — 9/11 accepted the package without rejecting it * Vulnerable MCP Project: reported more than 50 distinct vulnerabilities across MCP servers, clients, and infrastructure, with 13 rated critical ## **IOC & Artifacts** ### **SHA-256** * 216a2c99fd42c00f9323d8b16dd19f622f7f4778b2b1d7cf07a3de5621fd1546 * 91e5dbfaf45edf25fbc2168f92083e05dfa427afa7633e991392e33cc7427dad * 498fe8fb806cd0e6685f97fc7d74de769dae5a28cdc821557b7585ad5ad83147 * 62744baa8077bb8be237647fd78e3bea2ca0932bf4be3d5618600f97118095f8 * 1da8df487d30b988f3c350c065206726aaa13f079a07151cd42ab5579994b9de * c15693106682f2ddb26649cab6e1962a64537627cde4c5d3c79d5a0be8c1b5a8 * 66afc7d87d10dbe392898c4e5c613e0442fabb396415c2bef3a5ef2ac752c5ad * a33f40cab1ab7f971d3464af3e7595918107332b9e83342007571842b9e22826 * 3c858facbad66f5479e2c4add171421dc1b6488b36f33e7cff073aba585954a7 * fc1278f419e611bf40ca414099bfd9ad98a31ffb054371e8cb65a84849b00eaf ## **MITRE ATT&CK Mapping** | **Tactic** | **Technique ID** | **Technique Name** | **Notes** | | --- | --- | --- | --- | | Resource Development | T1583.001 | Acquire Infrastructure: Domains | GitHub Pages used as redirectors | | Resource Development | T1586.003 | Compromise Accounts: Cloud Accounts | Approximately 6,600 fake GitHub accounts | | Initial Access | T1195.001 | Supply Chain Compromise: Software Dependencies | Malicious GitHub repositories / MCP registries | | Execution | T1204.002 | User Execution: Malicious File | ZIP archive launcher (`setup.bat`) | | Execution | T1059 | Command and Scripting Interpreter | LuaJIT runtime executing obfuscated Lua payloads | | Persistence | T1053.005 | Scheduled Task/Job: Scheduled Task | SmartLoader creates scheduled tasks for persistence | | Defense Evasion | T1027 | Obfuscated Files or Information | Obfuscated Lua payload | | Defense Evasion | T1036 | Masquerading | Renamed LuaJIT runtime and disguised payload extensions | | Command and Control | T1102 | Web Service | GitHub Releases used for payload staging and delivery | | Command and Control | T1102 | Web Service (Blockchain-assisted C2) | Polygon smart contract used for dynamic C2 lookup *(single-source observation)* | | Collection | T1555.003 | Credentials from Password Stores: Browser | StealC harvests browser passwords and cookies | | Collection | T1539 | Steal Web Session Cookie | StealC steals active session tokens | | Collection | T1552.004 | Unsecured Credentials: Private Keys | StealC collects SSH private keys | | Exfiltration | T1041 | Exfiltration Over C2 Channel | Stolen data exfiltrated through the C2 channel | ## Comments The sentence with which Island concludes his report is worth pondering: "FakeGit did not need to breach anything." No CVEs, no zero-days, no zero-click exploits. This campaign operated purely on the trust architecture of the developer tool ecosystem — and it worked so well that it accumulated 14 million downloads before being fully exploited. About AgentBaiting: We believe that this is not a one-time technique but a recurring and more sophisticated pattern. The current mechanism of AI coding agents has no reliable mechanism to distinguish a valid open-source contribution from a purpose-built lure. This gap will exist until the registry, model provider, and enterprise all more seriously adopt vetting standards for agent-installable software — something the current pace of improvement suggests will take a long time. Regarding the severity for organizations in Vietnam: Vietnamese developers are adopting AI coding tools at a rapid pace — Cursor, GitHub Copilot, Claude Code, and MCP-enabled tools are becoming part of the normal workflow. But most organizations do not have internal governance for installing AI Skills or MCP servers, do not have a permission list, and do not have a review process. AgentBaiting's attack surface is expanding in parallel with adoption rate — while defense has not kept up. Regarding the StealC payload and blast radius: A compromised developer not only loses their personal credentials — but potentially exposes the entire production environment they have access to. In the AgentBaiting scenario, if the AI ​​agent is running with standing service account credentials (a fairly common pattern in CI/CD pipelines), the blast radius of a successful compromise can spread far beyond that developer's workstation. Comparison with traditional phishing: The difference isn't really technical — it's about control points. Security awareness training, email gateway, URL filter, and safe browsing policy are all designed for a threat model in which humans are the intermediary link between attacking content and execution. AgentBaiting bypasses that link completely. This is why FakeGit deserves attention at the architectural level, not just at the IOC level. ## Recommendation ### **Immediate (0–24h)** * Inventory of installed AI Skills and MCP servers: Lists all available Skills/MCP servers in the developer environment. For any item originating from a GitHub repository that has not been verified internally — consider uninstalling immediately and checking the host. * Hunt for the FakeGit pattern on the endpoint: * Find the LuaJIT process running from an unusual path `Get-Process | Where-Object { $_.Path -match "AppData|Temp|Downloads" }` * Check that Scheduled Task points to the user directory `Get-ScheduledTask | Where-Object {` `$_.Actions.Execute -match "AppData|Temp|Users"` `} | Format-List TaskName, Actions` * Rotate credentials at risk: On any system that has installed an AI Skill from an unverified public repo in the last 6 months — rotate now: browser passwords, SSH keys, session tokens, API keys, OAuth tokens. ### **Short-term (1–7 days)** * Deploy internal allowlist for AI tooling: Any AI Skill or MCP server that is allowed to be installed must come from an internally reviewed and approved list. Agent-driven autonomous discovery from the public registry must be disabled or require explicit human approval before execution. * Update detection rule for SmartLoader delivery pattern: * RULE: Flag ZIP archive also contains: (1) .bat or .sh launcher script (2) PE executable with name does not match function (check PE header) (3) Files with extension .txt / .ico / .lic contain binary content * Mandatory human review checkpoint: For every installation instruction coming from an AI agent — even if the agent does not provide a direct link — the original human review README must be present before executing any command. Log this review into change management. * Scan MCP registry listings: Check if the project name or internal tool is impersonated on LobeHub, Glama, MCP.so, MCP Market. ### **Long-term** * Apply SDLC governance to agent tooling: Skills, MCP servers, and agent plugins need to be included in the same dependency management process as traditional software — not a separate category with lower scrutiny. * Principle of Least Privilege for AI agents: AI agents should not run with a standing production credential or a service account with broad access. The limit scope of the credential agent can be used to the minimum necessary — this directly reduces the blast radius if the AgentBaiting attack is successful. * Engage model providers about agent controls: When deploying an AI coding agent for the developer team, work with the provider (Anthropic, Google, OpenAI) to understand the available controls: restrict discovery scope, disable external search, or require confirmation before the agent surface external resources. * Prepare for the next iterations: AgentBaiting in FakeGit is the first version to be documented. The next version can target model poisoning context (inject malicious content into agent memory/context) or prompt injection via README. Defense needs to be designed to handle unseen variants, not just defend according to the current IOC. ## Reference [AgentBaiting: How Fake AI Skills Deliver Malware at Scale](https://www.island.io/blog/agentbaiting-how-800-fake-ai-skills-and-mcp-servers-delivered-malware#representative-iocs) [FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware](https://thehackernews.com/2026/07/fakegit-campaign-uses-7600-github.html) [FakeGit and AgentBaiting: Malicious Repos Target AI Agents – Lab Space](https://labs.cloudsecurityalliance.org/research/csa-research-note-fakegit-agentbaiting-mcp-supply-chain-2026/) [FakeGit Campaign Floods GitHub With 7,600 Malware Repositories](https://windowsreport.com/fakegit-campaign-floods-github-with-7600-malware-repositories/)