FakeGit Campaign: How 7,600 Fake GitHub Repos Tricked AI Coding Agents Into Distributing Malware

Active since at least March 2025 and tied to a single Vietnamese-speaking operator, the campaign deployed nearly 7,600 malicious GitHub repositories, of which over 800 were disguised as AI Skills or Model Context Protocol (MCP) servers—the exact types of components that agents like Claude Code, Gemini CLI, and ChatGPT search for and recommend. By July 2026, GitHub's download counters recorded over 14 million events tied to the campaign files.

What Is AgentBaiting?

AgentBaiting is a supply-chain attack on the AI agent's trust model. Instead of relying on victims to stumble onto malicious links, the attackers engineered their fake repositories to be found and promoted by the AI agents themselves. The attack chain works as follows:

1. Fake AI Skills and MCP servers: More than 800 of the campaign's repos masqueraded as AI Skills (plugins for coding agents) or MCP servers—components that agents autonomously search for when a user asks to integrate a tool or service.
2. Listings on public AI registries: Attackers seeded over 600 malicious listings on public AI registries and directories, ensuring their repos appeared in agent search results.
3. Social engineering via READMEs: The malicious repos used copied legitimate projects, look-alike developer profiles, and convincing README files with instructions that the AI agents would trust and relay to users.
4. Autonomous recommendation: When a developer asked the agent to find a tool or initialize a project, the agent would search the web, discover one of these fake repos, read the README, and present the installation instructions—including a malware download—as a helpful recommendation.

Island Security lead researcher Oleg Zaytsev described the shift: "What was built to trick people now tricks AI agents too".

Malware Payloads: SmartLoader and StealC

The FakeGit campaign deployed a two-stage malware chain:

• SmartLoader: The initial payload delivered by the fake repos. It is a multistage LuaJIT-based loader that establishes persistence on the system, retrieves encrypted payload stages, and executes them in memory.
• StealC: The ultimate payload. An information-stealing malware that exfiltrates credentials, API keys, browser data, and other sensitive information from compromised Windows systems.

Scale of the Operation (as of July 2026)

Note: The download count of 14 million+ reflects all events recorded by GitHub's counters for the campaign files, which may include automated requests as well as genuine user downloads.

Researcher-Recommended Mitigations for Enterprises

Based on Island Security's analysis and cross-referenced reporting from Mozilla's 0din team and other security researchers, the key defenses are:

1. Maintain a curated, approved catalog of AI Skills, MCP servers, and agent extensions. Only allow agents to install components from this sanctioned list. Document origin, owner, repository, commit hash, and version for every entry.

2. Sandbox new agent capabilities. Before rolling out any new AI Skill or MCP server to the broader organization, evaluate it in an isolated, controlled environment.

3. Verify publisher and project integrity. Cross-check the publisher's identity, account age, and project history before trusting any third-party AI plugin. Treat high-star/high-download repos as potentially gamed.

4. Monitor agentic pathways. Implement monitoring for outbound requests from AI agents to external repositories, especially raw content downloads from GitHub that fall outside established developer baselines.

5. Restrict autonomous agent behavior. Configure AI coding agents to require user confirmation before installing new tools, running shell commands from README instructions, or downloading external packages.

6. Apply strict egress controls. Limit what endpoints AI agent infrastructure can reach, and maintain an "approved sources" allowlist for code and package downloads.

7. Treat public AI registries as untrusted. Assume any component discovered by an agent from a public registry may be malicious until verified through the approved catalog.