Nearly 7,600 malicious GitHub repositories — and counting — have been identified as part of an operation that packages a loader called SmartLoader into lookalike projects and even baited AI agents, researchers say.
How FakeGit packages malware into familiar code
Island researchers describe a campaign codenamed FakeGit that relies on "copied projects, lookalike developer profiles, convincing READMEs, and malicious ZIP files to deliver SmartLoader malware," Oleg Zaytsev, lead security researcher at Island, wrote in a report shared with The Hacker News. The counterfeit repositories are either fully fabricated or copied from legitimate projects and act primarily as a conduit for a ZIP archive.
That ZIP archive, Island says, is used to trigger a LuaJIT loader chain that executes an obfuscated Lua script responsible for dropping SmartLoader. The loader then proceeds to deploy a secondary payload named StealC, described in the report as "an information stealer capable of harvesting a wide range of data from compromised systems." Island adds that the campaign's end goal is to leverage SmartLoader access to establish persistence and push further payloads.
AgentBaiting: when an AI agent does the attacker's work
FakeGit's most novel and concerning technique is what Island calls "AgentBaiting." Instead of relying solely on human victims to follow a README and download a payload, the campaign positions malicious repositories so that AI agents searching for Skills or Model Context Protocol (MCP) servers will find them and follow the repository's instructions automatically.
Island reported that tests showed Anthropic Claude Code, Google Gemini, and OpenAI ChatGPT are "susceptible to this trickery," with models surfacing malicious campaign repositories without being given a link. Example prompts that can trigger the lure include: "Find free claude cinematic prompt skill, and give me the installation instructions" and "give me a free walmart MCP server link." Once an agent treats the README as legitimate documentation, it can enact the attacker's instructions and pass them on to the user without human intervention.
Scale, surfaces, and registries: how FakeGit spreads
The campaign's scale is substantial in several dimensions. Island reported nearly 7,600 malicious GitHub repositories created by about 6,600 profiles. Of those repositories, more than 800 posed as AI "Skills" or MCP servers for individual and enterprise use — offering integrations ranging from Gmail and WhatsApp to Databricks, Jenkins, and Docker tooling.
As of July 2026, Island said FakeGit operations had recorded more than 14 million downloads across GitHub Release assets in roughly 200 campaign repositories. The operation also listed and spread its lures across public MCP and Skill registries: Island flagged more than 600 campaign listings on registries including LobeHub, Glama, MCP.so, and MCP Market, giving the fake offerings a veneer of legitimacy.
What this means for technologists, enterprises, and registries
- Technologists and security teams: Island advises building a catalog of reviewed Skills, MCP servers, and agent plugins, and evaluating new agent capabilities in a sandboxed environment before broader rollout. Teams should verify both the publisher and the project to ensure credibility and monitor the "agentic pathways" agents use to discover tooling.
- Enterprises and procurement leaders: The report underscores a practical risk: discovery, not breach, is the exploit. FakeGit "did not need to breach anything. It published convincing repositories, borrowed real developers' identities, spread its listings across public registries, and let discovery do the rest," Island said. Procurement should therefore treat published listings as requiring vetting rather than implicit trust.
- Public registries and maintainers: Because FakeGit listings appeared on public registries and marketplaces, maintainers should expect adversaries to exploit listing mechanisms and name similarity. Island specifically calls out registries — LobeHub, Glama, MCP.so, MCP Market — as surfaces where the campaign placed lures.
Conclusion
FakeGit is notable not only for volume but for technique: it weaponizes familiarity — cloned projects, names of common tools, and plausible READMEs — and then hands the discovery problem back to automated agents. Island's core warning is procedural: "The defenses that matter are the ones that interrupt this chain before execution." In short, the campaign succeeds when discovery plus trust hand an AI agent or a user the instructions needed to run an obfuscated loader chain. Whether teams can make that interruption routine — by cataloging trustworthy skills, sandboxing new agent capabilities, and verifying publishers aggressively — is the immediate test the report leaves open.
