A large-scale operation, dubbed "FakeGit" by researchers, has been observed distributing SmartLoader and StealC malware through approximately 7,600 malicious repositories hosted on GitHub. These repositories have collectively accumulated over 14 million download events.
The campaign is believed to be a continuation of an earlier operation that utilized Lumma Stealer and was previously attributed to a threat actor tracked as Water Kurita by Trend Micro. The current iteration of the campaign has introduced a significant focus on artificial intelligence (AI) tools, agents, and workflows, a technique researchers at Island refer to as "AgentBaiting."
The AI-centric approach began in March and saw a peak in April with the creation of 300 AI-related GitHub repositories. This number has since grown to over 1,400 such repositories, all linking to SmartLoader or StealC malware downloads. More than 800 repositories specifically pretended to be AI skills or MCP (Minecraft Pocket Edition) servers.
These malicious repositories are designed to appear legitimate, often imitating popular consumer and enterprise tools like Gmail, WhatsApp, Databricks, Jenkins, and Docker. They feature convincing documentation, fabricated star and fork counts, copied project descriptions, and even use real developer account names to enhance their credibility.
The `README` files within these repositories direct users to download ZIP archives, which are presented as installers or project releases. However, these archives contain disguised Lua payloads that initiate the SmartLoader malware. Once active, SmartLoader establishes persistence through scheduled tasks, retrieves its command-and-control (C2) address via a Polygon smart contract, and then downloads additional encrypted stages from GitHub, ultimately delivering the StealC information stealer.
The "AgentBaiting" technique aims to increase the visibility of these malicious repositories to AI agents and improve the likelihood of their adoption. Researchers suggest that AI agents are prone to parsing the `README` contents as legitimate documentation, potentially leading them to recommend the repository or its associated ZIP file to human operators.
Tests conducted by Island researchers showed that AI models such as ChatGPT, Gemini, and Claude surfaced various malicious repositories when prompted with related tasks, sometimes even relaying the malicious installation instructions. Furthermore, over 600 listings for skills and MCP servers linked to the FakeGit campaign were found in public registries and catalogs, including LobeHub, Glama, MCP.so, and MCP Market. This indicates that the operation has successfully infiltrated public resources, enhancing the discoverability and perceived credibility of the malicious repositories.
In controlled testing, Claude Code was observed cloning malicious repositories and downloading the malicious files onto a test machine. However, the agent subsequently detected suspicious indicators and halted execution before the malware could fully execute. These tests were not designed to establish a definitive detection rate for coding agents.
Regarding the overall impact, GitHub's public download counters for 335 unique Release assets across 211 FakeGit repositories recorded a cumulative 14,084,688 download events. Oleg Zaytsev, Lead Security Researcher at Island, clarified that this figure includes repeated requests and automated activity and should not be interpreted as the number of infections.
Organizations are advised to maintain approved catalogs of skills and MCP servers, test new capabilities in isolated environments, and independently verify publishers and repositories. In cases where SmartLoader execution is suspected, all secrets on affected environments should be immediately rotated.
