FakeGit Uses 7,600 GitHub Repositories to Spread SmartLoader and StealC
Summary
Researchers say FakeGit used nearly 7,600 malicious GitHub repositories to spread SmartLoader and StealC. Island also found that AI agents could be lured into discovering fake repositories through the AgentBaiting technique.
Key points
- Researchers identified nearly 7,600 malicious repositories created by about 6,600 profiles; more than 800 posed as AI Skills or MCP servers.
- The repositories used copied projects, lookalike profiles, READMEs, and malicious ZIP files to deliver SmartLoader.
- A described delivery chain uses a ZIP archive and LuaJIT loader to run an obfuscated Lua script that drops SmartLoader, which can then deploy StealC.
- Island reported that tests found Claude Code, Gemini, and ChatGPT could surface malicious repositories without being given a link.
- The campaign recorded more than 14 million downloads across GitHub Release assets in about 200 campaign repositories as of July 2026, according to the article.
- More than 600 campaign listings were reported flagged across public MCP and Skill registries.
- Recommended defenses include reviewing Skills and MCP servers, testing agent capabilities in a sandbox, verifying publishers and projects, and monitoring agentic pathways.
Article Details
- Event Type
- Malware distribution campaign using malicious GitHub repositories and AI-agent lures
- Impact
- FakeGit used nearly 7,600 malicious repositories, including more than 800 posing as AI Skills or MCP servers, to distribute SmartLoader and then StealC. The campaign reportedly recorded more than 14 million downloads across GitHub Release assets in about 200 repositories. Island said its tests found Claude Code, Gemini, and ChatGPT susceptible to AgentBaiting, which can lead an AI agent to discover a malicious repository and relay its instructions.
People
Malware
SmartLoaderResearchers uncovered nearly 7,600 malicious GitHub repositories in the FakeGit campaign, including more than 800 fake AI Skills and MCP servers used to distribute SmartLoader and later StealC.StealCResearchers uncovered nearly 7,600 malicious GitHub repositories in the FakeGit campaign, including more than 800 fake AI Skills and MCP servers used to distribute SmartLoader and later StealC.
Vendors
AnthropicIsland said its tests revealed Anthropic Claude Code, Google Gemini, and OpenAI ChatGPT to be susceptible to this trickery, allowing the models to surface malicious campaign repositories without even being shown a link.GitHubResearchers uncovered nearly 7,600 malicious GitHub repositories in the FakeGit campaign, including more than 800 fake AI Skills and MCP servers used to distribute SmartLoader and later StealC.GoogleIsland said its tests revealed Anthropic Claude Code, Google Gemini, and OpenAI ChatGPT to be susceptible to this trickery, allowing the models to surface malicious campaign repositories without even being shown a link.OpenAIIsland said its tests revealed Anthropic Claude Code, Google Gemini, and OpenAI ChatGPT to be susceptible to this trickery, allowing the models to surface malicious campaign repositories without even being shown a link.
Products
ChatGPTThe new AgentBaiting technique can trick AI agents like Claude Code, Gemini, and ChatGPT into discovering and following malicious repositories on their own.Claude CodeThe new AgentBaiting technique can trick AI agents like Claude Code, Gemini, and ChatGPT into discovering and following malicious repositories on their own.GeminiThe new AgentBaiting technique can trick AI agents like Claude Code, Gemini, and ChatGPT into discovering and following malicious repositories on their own.GitHubResearchers uncovered nearly 7,600 malicious GitHub repositories in the FakeGit campaign, including more than 800 fake AI Skills and MCP servers used to distribute SmartLoader and later StealC.GlamaPublic registries like LobeHub and Glama helped fake listings appear legitimate.LobeHubPublic registries like LobeHub and Glama helped fake listings appear legitimate.MCP Marketthe malicious skills or MCP servers are listed on public registries like LobeHub, Glama, MCP.so, and MCP Market, giving them a false sense of legitimacy.MCP.soexacerbated when the malicious skills or MCP servers are listed on public registries like LobeHub, Glama, MCP.so, and MCP Market, giving them a false sense of legitimacy.