A large-scale malware operation called FakeGit has planted 7,600 malicious GitHub repositories distributing SmartLoader and StealC malware, with over 800 of those repositories impersonating AI skills and MCP (Model Context Protocol) servers. Researchers at enterprise browser platform Island identified a technique they call “AgentBaiting,” designed to increase repository visibility to autonomous AI agents that discover and install tooling from public catalogs.
The repositories have accumulated more than 14 million download events across 335 unique release assets in 211 repositories, according to BleepingComputer. Island’s lead security researcher Oleg Zaytsev clarified that the figure includes repeated requests and automated activity, so it should not be interpreted as a direct infection count.
How AgentBaiting Works
The campaign exploits the way AI agents autonomously discover third-party tools. Over 800 repositories impersonate AI skills, MCP servers, and agent workflows. These repos appeared more than 600 times across public AI registries and catalogs, including LobeHub, Glama, MCP.so, and MCP Market, according to BleepingComputer. Island’s researchers could not determine whether the listings were submitted manually or indexed automatically, but their presence made the repositories easier to discover and added credibility.
The repositories include convincing documentation, fabricated star and fork counts, copied project descriptions, and real developer account names. Many imitate consumer and enterprise tools such as Gmail, WhatsApp, Databricks, Jenkins, and Docker. Their README files direct visitors to download ZIP archives disguised as installers or project releases, which contain Lua payloads that trigger SmartLoader.
The Infection Chain
Once SmartLoader executes, it establishes persistence through scheduled tasks, retrieves its command-and-control address through a Polygon smart contract, and downloads additional encrypted stages from GitHub. The final payload is StealC, an information stealer.
Trend Micro previously attributed the campaign’s earlier iteration to a threat actor tracked as “Water Kurita,” which used Lumma Stealer. The AI-focused expansion began in March 2026 and peaked in April with the creation of 300 GitHub repositories linked to AI tools, according to Island’s research cited by BleepingComputer. The campaign has since grown to more than 1,400 AI-related repositories.
Agent Testing Results
In controlled testing, Island researchers found that ChatGPT, Gemini, and Claude surfaced various malicious repositories when prompted with related tasks, sometimes relaying installation instructions directly to users.
Island told BleepingComputer that in limited testing, Claude Code cloned malicious repositories and downloaded the malicious files onto the test machine. The agent subsequently detected suspicious indicators and stopped before execution. The tests were not designed to establish a detection rate, so they do not provide conclusive results on whether coding agents can consistently recognize the danger during execution.
Registry Poisoning at Scale
The campaign’s penetration of public AI registries represents a structural problem for agent ecosystems. Traditional software supply chain attacks target package managers like npm or PyPI. AgentBaiting targets the newer layer: skill marketplaces and MCP server directories that autonomous agents query to extend their capabilities.
Island recommends that organizations maintain approved catalogs of skills and MCP servers, test new capabilities in isolated environments, and verify publishers and repositories independently. Where SmartLoader execution is suspected, all secrets on impacted environments should be rotated immediately.