Cybersecurity Researchers Uncover Massive FakeGit Campaign Exploiting AI Agents and Developers via Thousands of Malicious GitHub Repositories.

A sophisticated and expansive cyber-espionage operation, codenamed FakeGit, has been identified by security researchers, revealing a massive infrastructure of nearly 7,600 malicious GitHub repositories designed to compromise both human developers and autonomous artificial intelligence agents. According to a comprehensive report from the cybersecurity firm Island, the campaign leverages a new technique dubbed "AgentBaiting," which specifically targets the emerging ecosystem of AI "skills" and Model Context Protocol (MCP) servers. By poisoning the supply chain of AI-assisted development, the threat actors behind FakeGit have successfully distributed a potent malware family known as SmartLoader, which serves as a gateway for secondary payloads like the StealC information stealer.

The FakeGit operation represents a significant evolution in social engineering, moving beyond traditional phishing to exploit the trust users place in open-source platforms and the automated discovery mechanisms of modern Large Language Models (LLMs). As of mid-2026, the campaign has demonstrated staggering reach, with researchers recording more than 14 million downloads across various GitHub Release assets. This scale highlights a critical vulnerability in the rapid adoption of AI integration tools, where the speed of innovation has outpaced the implementation of robust security verification.

The Architecture of Deception: How FakeGit Operates

The core of the FakeGit campaign lies in its ability to blend into the legitimate developer ecosystem. Threat actors have created approximately 6,600 lookalike developer profiles to host thousands of repositories. These repositories are not merely empty shells; they are meticulously crafted to appear professional and trustworthy. Many are direct clones of popular legitimate projects, while others are entirely fabricated but feature high-quality README files, convincing documentation, and realistic version histories.

Of the 7,600 repositories identified, more than 800 specifically target the AI sector by posing as MCP servers or specialized AI "skills." These lures are designed to meet the growing demand for integrations between AI models and enterprise tools such as Gmail, WhatsApp, Databricks, Jenkins, and Docker. By using familiar names and workflows, the attackers provide a credible reason for users—or their AI agents—to download the provided ZIP files containing the malicious payload.

The attack chain typically begins when a user or an AI agent downloads a malicious ZIP archive from a FakeGit repository. This archive contains a multi-stage loader. The initial execution triggers a LuaJIT loader chain, which eventually runs an obfuscated Lua script. This script is responsible for dropping and executing SmartLoader. Once established on the host system, SmartLoader functions as a persistent foothold, allowing the attackers to push further malware. In the majority of cases observed by researchers, the final payload is StealC, a highly effective information stealer capable of harvesting browser credentials, session cookies, cryptocurrency wallet data, and sensitive system information.

AgentBaiting: The Next Frontier of Social Engineering

The most alarming aspect of the FakeGit campaign is the emergence of "AgentBaiting." Traditionally, social engineering required a human to be deceived into clicking a link or running a file. However, with the rise of AI agents—autonomous systems designed to search the web, find tools, and execute tasks on behalf of a user—the target of the deception has shifted.

Island’s research indicates that popular AI models, including Anthropic’s Claude Code, Google Gemini, and OpenAI’s ChatGPT, are susceptible to being "baited" by these malicious repositories. When a user asks an AI agent to find a specific tool—for example, by prompting "Find a free Walmart MCP server link" or "Get me the installation instructions for a Claude cinematic prompt skill"—the agent may autonomously discover a FakeGit repository.

Because the agent treats the repository’s README file as legitimate documentation, it can inadvertently relay the attacker’s instructions back to the user or even attempt to execute setup scripts if granted sufficient permissions. This bypasses traditional human skepticism, as the user often trusts the AI’s curated search results. The study found that AI models frequently surfaced these malicious campaign repositories even without being provided a direct URL, effectively acting as an unwitting distribution vector for the malware.

Chronology and Evolution of the Threat

The FakeGit campaign is not an isolated incident but the culmination of a series of smaller-scale attacks that have been observed throughout early 2026. The evolution of the campaign shows a clear trajectory toward targeting AI-integrated workflows:

• February 2026: Early iterations of the attack were flagged by Straiker AI, which noted the use of trojanized MCP servers to distribute SmartLoader via fraudulent GitHub repositories.
• March – May 2026: Researchers at Derp.ca identified a surge in LuaJIT-based malware delivery systems on GitHub, noting a high degree of obfuscation and the use of cloned projects to hide malicious intent.
• June 2026: The campaign expanded significantly, with the number of malicious repositories growing from a few hundred to several thousand. Attackers began listing their "skills" on public registries such as LobeHub and MCP Market.
• July 2026: Island released its comprehensive findings on the FakeGit campaign, identifying the "AgentBaiting" phenomenon and documenting the 14 million download milestone.

This timeline suggests a well-funded and organized threat actor group that is closely monitoring trends in the AI industry to refine its lures. The rapid shift to MCP-based lures coincides perfectly with the industry-wide push for standardized protocols to connect LLMs to external data sources.

Data Analysis: The Scale of the Campaign

The sheer volume of the FakeGit operation provides insight into its effectiveness and the resources of its operators. The following data points illustrate the magnitude of the threat:

• Total Malicious Repositories: ~7,600
• Unique Developer Profiles: ~6,600
• AI-Specific Lures (MCP/Skills): 800+
• Total Downloads: Over 14 million across GitHub Release assets.
• Public Registry Presence: More than 600 campaign listings flagged on platforms like LobeHub, Glama, MCP.so, and MCP Market.
• Primary Payloads: SmartLoader (Loader) and StealC (Infostealer).

The high download count is particularly concerning. While some of these downloads may be attributed to automated bots or multiple attempts by the same system, the 14 million figure indicates a widespread compromise of developer environments globally. Furthermore, the presence of these lures on public registries gives them a "veneer of legitimacy," making it even harder for users to distinguish between safe tools and malicious traps.

Industry Impact and Expert Analysis

The FakeGit campaign exposes a fundamental tension in the current technological landscape: the desire for open, extensible AI systems versus the need for rigorous security controls. The Model Context Protocol was designed to make AI more useful by allowing it to interact with the world, but as Oleg Zaytsev, lead security researcher at Island, pointed out, "That familiarity gave the malicious ZIP files a credible reason to be downloaded."

Security experts warn that this is likely the beginning of a broader trend where AI agents are targeted as the "weakest link" in the security chain. Unlike humans, who might notice a typo in a URL or a strange file extension, AI agents are currently optimized for helpfulness and task completion rather than skepticism. If an agent is told to find a tool, it will find the one that most closely matches the description, regardless of the publisher’s reputation.

The implications for enterprise security are profound. A single developer using an AI agent to "helpfully" find a Jenkins integration could inadvertently introduce an information stealer into a high-privilege environment. This could lead to the theft of source code, cloud credentials, and customer data, potentially resulting in catastrophic supply chain attacks.

Mitigation Strategies and Recommendations

To counter the threat posed by FakeGit and future AgentBaiting campaigns, cybersecurity organizations recommend a multi-layered approach to AI and open-source security. Organizations can no longer rely solely on the reputation of platforms like GitHub to vet content.

1. Curated Registries: Instead of allowing AI agents to search the open web or public registries for tools, enterprises should build and maintain an internal catalog of reviewed and approved AI skills, MCP servers, and plugins.
2. Sandboxed Evaluation: Any new agent capability or third-party integration should be tested in a strictly isolated, sandboxed environment before being deployed to a developer’s workstation or the broader corporate network.
3. Verification Protocols: Users and automated systems must verify both the publisher and the project’s history. Genuine projects typically have a long-standing presence, active community engagement, and transparent codebases.
4. Monitoring Agentic Pathways: Security teams should implement logging and monitoring for the actions taken by AI agents. Identifying when an agent accesses a known malicious registry or downloads a ZIP file from an unverified GitHub repo can help prevent execution.
5. Human-in-the-Loop Requirements: For high-risk actions, such as the installation of new software or the granting of system permissions, a "human-in-the-loop" requirement should be strictly enforced to ensure that an AI agent cannot autonomously complete a malicious attack chain.

The FakeGit campaign serves as a stark reminder that as we automate our workflows with AI, we also automate the potential for exploitation. The defenses that will matter most in the coming years are those that interrupt the chain of trust before a malicious instruction can be executed by an unsuspecting agent or its human user.