Cybersecurity researchers have discovered nearly 7,600 malicious GitHub repositories, more than 800 of which claim to distribute a malware family called SmartLoader as part of an ongoing campaign codenamed Artificial Intelligence (AI) skills or Model Context Protocol (MCP) servers. fakegit.
“Fakegit SmartLoader uses copied projects, look-alike developer profiles, trusted readme, and malicious ZIP files to distribute malware,” said Oleg Zaytsev, lead security researcher at Island, in a report shared with The Hacker News.
The ultimate goal of these attacks is to take advantage of the access provided by SmartLoader to establish persistence and push secondary payloads, such as StealSee, an information stealer capable of gathering a wide range of data from compromised systems.
It is worth mentioning here that the use of trojanized MCP servers to distribute SmartLoader and SteelC was flagged earlier this year by Stryker AI and subsequently by Derp.ca. But one worrying aspect of FakeGit is what has been dubbed AI-powered development agentbetting.
This happens when an AI agent searching for a skill or MCP server inadvertently discovers one of these fake GitHub repositories, allowing it to do the attacker’s bidding on its own without any human user intervention.
Island said its tests showed that Anthropic Cloud Code, Google Gemini and OpenAI ChatGPT are vulnerable to this trick, allowing models to expose malicious campaign repositories even without showing the link. In other words, a technology founded with the original intention of socially engineering humans now has the ability to similarly deceive an AI agent acting on their behalf.
Of the 7,600 malicious GitHub repositories created by approximately 6,600 profiles, 800 were presented as skills or MCP servers for personal and enterprise use, ranging from Gmail and WhatsApp integrations to Databricks, Jenkins, and Docker tooling. As of July 2026, the FakeGit operation has recorded over 14 million downloads on GitHub release assets in nearly 200 campaign repositories.
“The repository was designed to meet the demand already forming around AI capabilities, borrowing names and workflows from familiar consumer and enterprise tools,” Zaytsev explained. “That familiarity gave a credible reason to download malicious ZIP files, while the README guided users or agents from routine setup into the SmartLoader attack chain.”
The fake repositories, either completely constructed or copied from legitimate projects, serve as a conduit for a zip archive, which is then used to trigger the LuaJIT loader chain, leading to the execution of an obfuscated Lua script responsible for spawning the SmartLoader. The loader then proceeds to deploy the SteelSea.
Agentbaiting increases this threat even further, as it opens the door to a scenario where an AI agent can be induced to discover a FakeGit repository without providing a malicious link by giving a prompt like this: “Find the free Cloud Cinematic Prompt skill, and give me installation instructions” or “Give me a free Walmart MCP server link.”
“When attempting to complete a task, it may automatically discover a FakeGit repository, treat the Readme as legitimate documentation, and deliver the attacker’s instructions to the user,” Island said. “Fakegit designed its AI attraction around this path.”
The technique once again demonstrates how routine AI-assisted search operations can be turned into an alley for malicious code execution, a problem that is further exacerbated when malicious skills or MCP servers are listed on public registries such as LobHub, Glamma, MCP.SO and MCP Market, giving them a false sense of legitimacy. Over 600 campaign listings have been flagged in the public MCP and skills registries.
To counter the threat, it is advisable to create an inventory of reviewed skills, MCP servers and agent plugins, evaluate new agent capabilities in a sandboxed environment before wider rollout, verify both the publisher and the project to ensure reliability, and monitor agentic routes.
Island said, “Fakegit did not need to violate anything. It published trusted repositories, borrowed the identities of real developers, spread its listings in public registries, and let Discovery do the rest.”
“With agentbaiting, that discovery no longer requires a person: An agent discovering the skill or MCP server can find the bait, read the attacker’s readme, and carry out its instructions. The defenses that are critical are interrupting this chain before execution.”
