A Sophisticated Malware Campaign Exploits GitHub Repositories, Infiltrating Public AI Registries and Catalogs
In a brazen and highly sophisticated operation, attackers have created over 7,600 malicious GitHub repositories to distribute SmartLoader and StealC malware. Dubbed the “FakeGit” campaign, this large-scale effort has accumulated more than 14 million downloads from public download counters on the platform.
At its core, FakeGit is an example of a tactic known as “agentbaiting,” where attackers intentionally create fake or malicious repositories that are likely to be discovered by AI agents and developers. This technique increases the likelihood of the repository being used, exploited, or even downloaded by unsuspecting users. In this case, researchers found that the campaign created more than 1,400 repositories related to AI tools, agents, and workflows, all linked to malware downloads.
The FakeGit campaign’s modus operandi is to create convincing GitHub repositories that mimic popular consumer and enterprise tools such as Gmail, WhatsApp, Databricks, Jenkins, and Docker. These repositories include fabricated stars and fork counts, copied project descriptions, and real developer account names – all designed to make them appear legitimate. The README files in these repositories direct visitors to download ZIP archives that pose as installers or project releases but are actually disguised Lua payloads.
Once SmartLoader is active, it establishes persistence through scheduled tasks, retrieves its command-and-control (C2) address from a Polygon smart contract, and downloads additional encrypted stages from GitHub. Ultimately, the StealC information stealer is delivered, allowing attackers to pilfer sensitive data from compromised systems.
The use of agentbaiting in this campaign has significant implications for public AI registries and catalogs. Researchers found that over 600 listings for skills and MCP servers linked to FakeGit have been listed in these resources. This not only increases the visibility of malicious repositories but also adds to their credibility, making them more likely to be used by developers and AI agents.
In a controlled testing scenario, researchers were able to clone malicious repositories using Claude Code, an AI coding agent. However, the agent detected suspicious indicators before execution, stopping the malware from spreading further.
The impact of this campaign is far-reaching, with 14 million downloads recorded across 211 GitFake repositories. While this figure includes repeated requests and automated activity, it highlights the need for organizations to maintain approved catalogs of skills and MCP servers, test new capabilities in isolated environments, and verify publishers and repositories independently.
To mitigate the risks associated with this campaign, security teams should prioritize testing every layer of their environment before attackers do. This involves verifying the integrity of public AI registries and catalogs, as well as implementing robust detection and response mechanisms to identify and contain malicious activity.
As the threat landscape continues to evolve, it is essential for organizations to stay vigilant and proactive in their defense strategies. By understanding the tactics and techniques used by attackers like those behind the FakeGit campaign, security teams can better prepare themselves to detect and respond to emerging threats.
Source: Bleeping Computer — 2026-07-21