The technical shift here is not the malware chain itself, but the discovery path into it. The campaign shows how AI coding agents can become the first point of trust in a software supply-chain attack: they search, rank, and surface repositories before a human ever inspects the source. For teams adopting assistants that browse GitHub or MCP registries, that means the attack surface now includes agent-driven retrieval, not just user clicks.
Architecturally, this is an integration problem as much as a security problem. Skills, MCP servers, and other capability registries create a wide trust boundary across GitHub, marketplaces, and developer toolchains. A repository can look like routine setup documentation while actually steering an autonomous agent into a malicious download flow. That makes provenance checks, publisher verification, and artifact validation essential controls at the point where AI tools translate โfind me a capabilityโ into executable instructions.
Operationally, the risk is variance. If one agent run flags a repo and another recommends it, teams cannot rely on a single model response as a safety gate. The practical implication is to treat AI-discovered dependencies like unvetted third-party software: isolate first execution, inspect release artifacts, and require human review before any script, ZIP, or installer reaches a workstation or pipeline.
For platform and security teams, the key lesson is to instrument the agent path. Visibility into what repositories were queried, which registries were consulted, and what files were opened becomes part of threat detection. Without that telemetry, defenders may only see the final malware stage, not the AI-mediated decision chain that enabled it.
Threat actors continue to find new ways to incorporate AI into schemes aimed at luring developers into downloading malware from fake repositories.
The latest example involves almost 7,600 malicious GitHub repositories that are being used to distribute a loader and an information-stealer. The FakeGit campaign is nothing new, with Oleg Zaytsev, lead security researcher with Island, noting that it and SmartLoader have been haunting developers for years with false GitHub repositories that deliver the malware.
Whatโs new is that the bad actors behind FakeGit have added AI into the mix, with many of the repositories presenting as AI skills or Model Context Protocol (MCP) servers and driving exposure via AI registries. Theyโre part of a technique Island calls โAgentBaiting,โ which happens when a developer sends out an AI agent to autonomously find something they can use within GitHub repositories.
โThis brought an established malware operation into the workflows people and agents use to discover and install new AI capabilities,โ Zaytsev wrote in a report. โAn AI agent searching for a new capability such as a Skill or an MCP server can discover a campaign repository on its own, treat the attackerโs README as legitimate documentation, and hand the installation instructions to the user.โ
Surfacing Malicious Repositories
Island researchers in tests found that Anthropicโs Claude Code, Googleโs Gemini, and OpenAIโs ChatGPT all pitched malicious campaign repositories to developers without being shown a link, he wrote, adding that โa playbook built to deceive people now deceives the agents acting on their behalf.โ
The 7,600 or so malicious GitHub repositories confirmed by Island were created by about 6,600 profiles, with some 1,400 of those tied to AI tools, agents, or workflows, and more than 800 posing as Skills or MCP servers that reach from tools in such environments as Gmail, WhatsApp integrations, Databricks, Jenkins, and Docker, according to Zaytsev.
As of this month, there have been more than 14 million downloads from about 200 of the campaignโs repositories. Tied to the campaign were thousands of other repositories that embedded malicious ZIP files directly in the project, where downloads arenโt publicly counted.
Fast-Scaling Campaign
That said, the AI-focused part of the campaign ramped up quickly, he wrote. According to GitHub creation dates, that started to build in March and peaked in April, when almost 300 such AI-related repositories were created.
โThe repositories were designed to meet demand already forming around AI capabilities, borrowing the names and workflows of familiar consumer and enterprise tools,โ he wrote. โThat familiarity gave the malicious ZIP files a credible reason to be downloaded, while the README guided users or agents from what appeared to be routine setup into the SmartLoader attack chain.โ
According to Island, the fraudulent repositories are made to resemble real projects, and at times are simply copies of them.
If a fake repository is chosen, the โDownload Latest Releaseโ button sends the developer to a malicious ZIP archive inside, which includes instructions for downloading, extracting, and running the application. This kicks off the attack chain, starting with a heavily obfuscated 300 KB Lua payload that is disguised as a text, icon, license, or data file.
Next Comes SmartLoader, StealC
From there, SmartLoader is dropped, which then deploys StealC, which can steal a range of information, including browser passwords and extension data, cookies, active sessions, screenshots, host information, and email and remote-access credentials.
โThe malware chain itself is familiar,โ Zaytsev wrote. โWhat changes is the route that leads to execution.โ
That route is exploiting the autonomous capabilities of AI agents. The agent doesnโt need to be given a malicious link. Instead, it can discover a FakeGit repository itself, treat the README file as legitimate, and then send the bad actorโs instructions to the user. This is AgentBaiting, and the FakeGit operators built the AI-based lures around it.
Top Coding Agents Fall for It
The Island researchers tested it using Anthropicโs Claude Code developer assistant, watching the model search the web, follow results through an MCP marketplace and GitHub, and open two repositories. One was benign, the other a FakeGit repository in the malicious skills category. Claude Code recommended the benign repository, but saw the malicious one as a legitimate alternative.
In other tries, the AI model detected the malicious content in the fraudulent repository and didnโt recommend it.
โThat variability is the point: it independently discovered a campaign repository and, in one run, turned its attacker-written README into actionable installation guidance,โ he wrote. โAt the scale of this campaign, even an occasional miss creates a path to malware execution.โ
Tests on both Gemini and ChatGPT showed similar results.
No Breach Needed
Zaytsev stressed that the FakeGit operators didnโt have to breach anything in the campaign.
They โpublished convincing repositories, borrowed real developersโ identities, spread its listings across public registries, and let discovery do the rest,โ he wrote. โWith AgentBaiting, that discovery no longer requires a person at all: an agent searching for a Skill or MCP server can find the lure, read the attackerโs README, and carry its instructions forward.โ
Organizations need defenses to interrupt the chain before it executes. That includes evaluating each new capability in an isolated environment first, verifying the publisher and the project, and keeping an eye on the paths AI agents go down.
Island researchers arenโt the only ones to detect such activity. Straiker AI in February reported a campaign using fake GitHub accounts to exploit the MCP ecosystem and a cloned Oura Ring server to sneak into developer environments with info-stealing malware. A month later, Derp.ca wrote about FakeGit distributing Lua-based malware through GitHub.
FakeGit Targets AI Coding Agents with Malicious GitHub Repos
Enjoyed this article? Sign up for our newsletter to receive regular insights and stay connected.