FakeGit: 7,600 Fake GitHub Repositories Are Now Baiting AI Agents Too

Researchers at Island have uncovered a large-scale malicious campaign dubbed FakeGit: some 7,600 fake repositories on GitHub, created by roughly 6,600 profiles. More than 800 of them pose as AI skills (Skills) or Model Context Protocol (MCP) servers — from integrations with Gmail and WhatsApp to tools for Databricks, Jenkins and Docker.

The scheme relies not on hacking, but on trust. The attackers clone real projects, fake developer profiles, write convincing READMEs and bundle in malicious ZIP archives. Familiar names and workable use cases give the victim a reason to download the file, while the installation instructions gently lead from routine setup to running malicious code. As of July 2026, files from the releases of roughly 200 repositories in the campaign had been downloaded more than 14 million times.

The infection chain

The ZIP archive launches a LuaJIT-based loader, which executes an obfuscated Lua script that installs SmartLoader. The loader gains persistence on the system and delivers a secondary payload — the StealC infostealer, which harvests all manner of data from infected machines. The use of trojanized MCP servers to deliver SmartLoader and StealC had already been noted earlier by researchers at Straiker AI and Derp.ca.

AgentBaiting: bait for AI

The truly alarming novelty of FakeGit is a technique named AgentBaiting. Social engineering, originally designed for humans, now deceives an AI agent acting on a person's behalf just as effectively. An agent tasked with finding the right skill or MCP server stumbles onto a fake repository itself, takes the README for legitimate documentation, and passes the attacker's instructions along to the user — or carries them out itself, with no human involved.

In Island's tests, Anthropic Claude Code, Google Gemini and OpenAI ChatGPT all fell for the ruse: the models served up links to malicious repositories even without being pointed to them directly. All it took was a request like “find a free skill for cinematic Claude prompts and give me the installation instructions” or “give me a link to a free MCP server for Walmart.”

The situation is made worse by public registries of skills and MCP servers — LobeHub, Glama, MCP.so, MCP Market. Being listed there lends the fakes an air of legitimacy; more than 600 entries from the campaign have already been flagged in these registries.

How to protect yourself

Island recommends maintaining a catalog of vetted skills, MCP servers and plugins, first trying out new agent capabilities in a sandbox, verifying both the publisher and the project itself, and monitoring agent routes. “FakeGit didn't hack anything — it published convincing repositories, borrowed the identities of real developers, and left the rest to the search mechanism itself,” the researchers conclude. “With AgentBaiting, a human is no longer even needed for that. What matters are the defenses that break the chain before the moment of execution.”

Source: The Hacker News