Cybercriminals are using thousands of fake GitHub repositories to spread malware, specifically targeting the rapidly growing AI ecosystem. Researchers describe a new technique in which not only developers but also AI agents are tricked into recommending or downloading malicious software.
According to researchers at browser security firm Island, the campaign, dubbed FakeGit, includes approximately 7,600 malicious GitHub repositories. Of these, more than 1,400 pose as AI tools, AI agents, or MCP servers, BleepingComputer reports. Collectively, the repositories account for more than 14 million recorded downloads, though not all of those downloads resulted in infections.
AI tools as bait
The attackers create convincing copies of existing open-source projects. The repositories contain extensive documentation, fake star and fork counts, and references to well-known developers. Many projects appear to originate from popular platforms and software, such as Gmail, WhatsApp, Databricks, Jenkins, and Docker.
Since March, the campaign has increasingly focused on AI. Hundreds of repositories were specifically set up around AI skills, MCP servers, and agent workflows. At the same time, these projects appeared in hundreds of public AI catalogs and registries, making them easier to find for both developers and AI systems.
The researchers call this approach “AgentBaiting”: the deliberate optimization of malicious repositories to cause AI assistants to recognize and recommend them as legitimate sources.
During controlled tests, ChatGPT, Gemini, and Claude were found to suggest various malicious repositories when asked for relevant AI tools. In some cases, the models also provided the installation instructions included in the README files.
Island also found that more than 600 listings for the spoofed projects ended up in public AI registries and catalogs, including LobeHub, Glama, MCP.so, and MCP Market. The researchers were unable to determine whether these listings were added manually or indexed automatically.
Claude Code went a step further in a limited test. The AI agent cloned a malicious repository and downloaded the associated files to a test system. The system then detected suspicious indicators and halted execution before the malware was actually launched. The researchers emphasize that this test does not indicate how reliably AI coding agents detect such attacks in practice.
Malware retrieves additional components
The repositories direct users to ZIP files that appear to be normal software releases. In reality, these files contain Lua payloads that activate the SmartLoader malware.
Once installed, SmartLoader ensures persistent access to the system via scheduled tasks. The malware then retrieves the address of its command-and-control server via a smart contract on the Polygon blockchain. Additionally, encrypted components are subsequently downloaded from GitHub, after which the StealC infostealer is ultimately installed.
For 335 release files across 211 repositories, GitHub recorded over 14 million download requests. According to Island, this number also includes automated downloads, scanners, and repeated requests. The figure, therefore, cannot be equated with the number of infected systems.
The researchers advise organizations to use only verified catalogs of AI skills and MCP servers, to test new AI functionality in an isolated environment first, and to independently verify the origin of repositories. If SmartLoader is suspected to have been executed, they recommend replacing all passwords, API keys, and other secrets in the affected environment immediately.