FakeGit campaign uses 7,600 GitHub repos to push SmartLoader malware

Cybersecurity researchers have uncovered a massive, sophisticated operation dubbed “FakeGit” that has successfully weaponized the GitHub ecosystem to distribute information-stealing malware on a global scale. The campaign, which leverages a novel technique known as "AgentBaiting," has utilized more than 7,600 malicious repositories to trick both human developers and autonomous artificial intelligence (AI) agents into downloading infectious payloads. According to data released by the enterprise browser platform Island, the operation has already recorded more than 14 million cumulative download events, marking it as one of the most significant supply-chain threats targeting the burgeoning AI development sector.

The FakeGit operation represents a strategic evolution in cybercrime, shifting focus from traditional social engineering of human users to the exploitation of automated AI workflows. By poisoning public registries and creating highly convincing repository environments, the threat actors behind the campaign—identified by researchers at Trend Micro as "Water Kurita"—have successfully bypassed conventional security filters to deliver the SmartLoader and StealC malware families.

The Rise of AgentBaiting and AI Ecosystem Poisoning

At the heart of the FakeGit campaign is a technique researchers have termed "AgentBaiting." This method involves optimizing malicious GitHub repositories to be discovered, parsed, and recommended by AI-powered coding assistants and autonomous agents. As developers increasingly rely on tools like ChatGPT, Claude, and Gemini to find code snippets, libraries, and Model Context Protocol (MCP) servers, threat actors have found a new vector for infection.

Island’s research indicates that over 800 of the 7,600 repositories were specifically designed to masquerade as AI tools, "skills," or MCP servers. These repositories appeared more than 600 times in public AI registries and catalogs, including popular platforms such as LobeHub, Glama, MCP.so, and MCP Market. When an AI agent is tasked with finding a solution for a specific development problem, it may crawl these registries, find the malicious entry, and present it to the human user as a legitimate recommendation.

In many cases, the AI agents go beyond mere recommendation. During controlled testing, researchers observed that certain autonomous agents, such as Claude Code, actually cloned the malicious repositories and downloaded the files onto the host machine. While some agents were able to detect suspicious indicators before final execution, the fact that the initial stages of the attack were facilitated by the AI itself highlights a critical vulnerability in the modern software development lifecycle.

Anatomy of the FakeGit Repositories

The success of the FakeGit campaign relies on an extraordinary level of mimicry and deception. The threat actors did not simply upload empty repositories; they built a sprawling infrastructure of "shadow" projects that imitate high-profile consumer and enterprise tools. Affected brands and technologies include Gmail, WhatsApp, Databricks, Jenkins, and Docker.

To establish credibility, the attackers employed several "black hat" SEO and social proofing techniques:

1. Fabricated Engagement: The repositories featured inflated star counts and fork numbers to simulate a popular and trusted community project.
2. Copied Documentation: README files were meticulously crafted, often directly copying descriptions and documentation from legitimate projects to avoid immediate suspicion.
3. Identity Theft: The repositories were frequently associated with the names of real, reputable developer accounts, making it difficult for users to distinguish the fake from the genuine project through a cursory glance.
4. Deceptive Releases: The README files directed users to download ZIP archives presented as "installers" or "project releases." In reality, these archives contained the initial stage of the malware infection chain.

The Technical Execution Path: From Lua to StealC

The FakeGit attack chain is a multi-stage process designed to evade detection by signature-based antivirus solutions. Once a user or agent downloads and extracts the malicious ZIP file, the execution begins with a disguised Lua payload. This payload acts as the primary trigger for SmartLoader, a sophisticated downloader malware.

SmartLoader is designed for persistence and stealth. Upon activation, it establishes a foothold in the victim’s system by creating scheduled tasks, ensuring it can survive system reboots. One of the most unique aspects of the FakeGit infrastructure is its use of blockchain technology for Command and Control (C2) resilience. SmartLoader retrieves its C2 server address through a Polygon smart contract. By using a decentralized ledger, the attackers ensure that their infrastructure cannot be easily taken down by traditional domain seizures or IP blocking.

Once communication with the C2 is established, SmartLoader downloads additional encrypted stages directly from GitHub. These stages eventually culminate in the deployment of StealC, a potent information stealer. StealC is a C-based malware that has gained popularity in the cybercriminal underground for its ability to exfiltrate sensitive data, including:

• Browser credentials and cookies.
• Cryptocurrency wallet private keys.
• Session tokens for enterprise platforms.
• System metadata and file structures.

Chronology and Evolution of Water Kurita

The FakeGit operation is not an isolated incident but rather a continuation and expansion of previous activity. Researchers at Trend Micro have tracked the threat actor behind this campaign under the alias "Water Kurita." Historically, this actor was linked to operations distributing Lumma Stealer, another high-profile infostealer.

The shift toward AI-centric targeting began in early 2024. Island’s data shows that the AI focus was introduced in March and reached a fever pitch in April, during which time over 300 GitHub repositories specifically linked to AI tools were created. By mid-2024, the campaign had grown to include over 1,400 AI-related repositories, representing nearly 20% of the total FakeGit infrastructure.

The transition from targeting general developers to specifically focusing on AI agents suggests that Water Kurita is a forward-thinking threat actor capable of adapting to technological shifts. By exploiting the trust that users place in AI-curated content, the actor has found a way to "automate" the delivery of malware to high-value targets in the tech and enterprise sectors.

Quantifying the Impact: 14 Million Downloads

The scale of the FakeGit campaign is reflected in the massive download statistics recorded by GitHub’s public counters. Island reported that 335 unique release assets across 211 analyzed repositories accounted for 14,084,688 cumulative download events.

However, Oleg Zaytsev, Lead Security Researcher at Island, noted that these figures require careful interpretation. While 14 million downloads indicate a massive reach, the number includes repeated requests, automated bot activity, and repeated downloads by the same users. Therefore, the download count should not be conflated with the total number of unique infections. Nevertheless, the sheer volume of traffic suggests that a significant number of developers and systems have been exposed to the SmartLoader payloads.

Official Responses and Industry Reactions

The discovery of the FakeGit campaign has prompted a re-evaluation of security protocols within the AI development community. Registry providers like LobeHub and MCP Market have been alerted to the presence of poisoned listings, and efforts are underway to purge malicious entries from public catalogs.

GitHub has a history of taking down malicious repositories when they are reported, but the sheer volume of the FakeGit operation—7,600 repos and counting—poses a significant challenge for automated moderation systems. The use of legitimate-looking code and documentation allows these repositories to hide in plain sight for extended periods.

Security experts emphasize that the responsibility for safety is shifting toward the consumers of AI tools. "The emergence of AgentBaiting demonstrates that we can no longer assume that code recommended by an AI is safe," said one industry analyst. "The AI is only as good as the data it indexes, and currently, that data is being actively poisoned by sophisticated actors."

Strategic Recommendations for Organizations

In light of the FakeGit threat, cybersecurity firms are advising organizations to adopt a "Zero Trust" approach to AI-assisted development. Recommendations for mitigation include:

1. Curation of AI Skills: Organizations should maintain internally approved catalogs of AI skills and MCP servers. Developers should be discouraged from using unverified third-party registries for production-level work.
2. Isolated Testing: Any new AI-suggested tool, library, or repository should be tested in a sandbox or isolated virtual environment before being integrated into the main development branch.
3. Independent Verification: Human oversight remains critical. Developers should independently verify the publisher of a repository, checking for genuine community engagement and historical longevity rather than just star counts.
4. Immediate Remediation: In environments where a SmartLoader infection is suspected, the response must be swift. Because StealC focuses on credential theft, organizations must rotate all secrets, including API keys, passwords, and session tokens, immediately upon discovery of the breach.

The FakeGit campaign serves as a stark reminder of the risks associated with the rapid adoption of AI in the software supply chain. As autonomous agents become more integrated into daily operations, the battle for the integrity of public repositories and AI registries will likely become a primary front in the ongoing war against global cybercrime.