Malicious GitHub Repositories Push SmartLoader and StealC Malware to Millions of Developers
A massive operation, dubbed “FakeGit,” has been pushing malware through 7,600 malicious GitHub repositories that have accumulated over 14 million downloads. The campaign is using a technique called “agentbaiting” to lure in AI agents and developers, making it easier for the attackers to spread their malware.
The FakeGit operation is considered a continuation of an older threat actor known as “Water Kurita,” which was attributed to a group tracked by Trend Micro researchers. In March, the campaign shifted its focus to AI tools, creating 300 GitHub repositories linked to AI skills and workflows. By April, this number had grown to over 1,400 repositories related to AI tools, agents, and workflows.
The malicious repositories are designed to mimic legitimate tools such as Gmail, WhatsApp, Databricks, Jenkins, and Docker. They include convincing documentation, fabricated stars and fork counts, copied project descriptions, and real developer account names. Visitors are directed to download ZIP archives that pose as installers or project releases but contain Lua payloads disguised as malware.
Once the SmartLoader malware is activated, it establishes persistence through scheduled tasks, retrieves its command-and-control (C2) address from a Polygon smart contract, and downloads additional encrypted stages from GitHub. Ultimately, this leads to the delivery of the StealC information stealer.
Researchers at Island have identified an emerging technique called AgentBaiting, where malicious repositories are designed to increase their visibility to AI agents and improve the chances of being used. In a typical scenario, agents may parse README contents as legitimate documentation and recommend the repository or ZIP file to human operators. Island’s tests showed that ChatGPT, Gemini, and Claude surfacing various malicious repositories when prompted with related tasks.
The presence of these listings in public registries and catalogs has made it easier for attackers to penetrate the ecosystem and poison public resources. The researchers found over 600 listings for skills and MCP servers linked to the FakeGit campaign, including LobeHub, Glama, MCP.so, and MCP Market.
While Island’s testing showed that coding agents can detect suspicious indicators and stop execution before it happens, this does not necessarily mean that all AI agents will consistently recognize the danger. The broader impact of the campaign is significant, with 14 million cumulative download events recorded across 211 GitFake repositories.
In light of these findings, Island recommends that organizations maintain approved catalogs of skills and MCP servers, test new capabilities in isolated environments, and verify publishers and repositories independently. If SmartLoader execution is suspected, security teams should rotate all secrets on impacted environments immediately and test every layer before attackers do.
As the threat landscape continues to evolve, it’s essential for developers and security teams to stay vigilant and adapt their strategies to counter emerging threats like AgentBaiting. By maintaining a proactive approach and verifying the authenticity of tools and repositories, we can reduce the risk of falling victim to these types of attacks.
Source: Bleeping Computer — 2026-07-21