FakeGit Campaign Uses Thousands of GitHub Repositories to Distribute SmartLoader

Security researchers have identified a large-scale campaign that uses fraudulent GitHub repositories to distribute SmartLoader malware and, in some cases, the StealC information stealer. Dubbed FakeGit, the operation has created almost 7,600 malicious repositories through roughly 6,600 accounts, according to research from Island.

More than 800 repositories reportedly impersonated artificial intelligence skills or Model Context Protocol (MCP) servers. The projects mimicked tools and integrations associated with services including Gmail, WhatsApp, Databricks, Jenkins and Docker. Some were newly created, while others copied the appearance and content of legitimate open-source projects.

The repositories use persuasive names, developer profiles and README files to encourage downloads. In approximately 200 campaign repositories, GitHub Release assets had accumulated more than 14 million downloads by July 2026. The downloaded ZIP archives initiate a LuaJIT-based execution chain that runs an obfuscated Lua script, installs SmartLoader and can subsequently deploy StealC, which is designed to collect sensitive information from infected systems.

AI agents become part of the attack path

Island described an evolution of the campaign called “AgentBaiting.” Instead of requiring a victim to receive a direct malicious link, attackers design repository names and documentation to appear in the results of AI-assisted searches for skills, plugins or MCP servers.

In testing, the researchers said Claude Code, Google Gemini and ChatGPT surfaced campaign repositories when given requests for free skills or MCP integrations. An agent could then interpret the repository’s README as installation guidance and relay the instructions to a user, potentially moving the attack closer to execution without a person deliberately seeking malware.

More than 600 related listings have reportedly appeared on public skill and MCP registries, including LobeHub, Glama, MCP.so and MCP Market. Such listings may give malicious projects an additional appearance of legitimacy.

Recommended safeguards

• Maintain an approved inventory of skills, MCP servers and agent plugins.
• Test new capabilities in isolated, sandboxed environments before deployment.
• Verify repository ownership, publisher identity and project history.
• Monitor agent workflows for downloads, installation commands and other execution paths.

The campaign highlights how public code-hosting and AI discovery systems can combine to create a software supply-chain risk, even without a direct compromise of a trusted service.