FakeGit Campaign Unleashes SmartLoader and StealC Malware Through 7,600 Malicious GitHub Repositories, Exploiting AI Ecosystem

A sophisticated and large-scale cyber operation, codenamed "FakeGit," has successfully weaponized over 7,600 malicious repositories on GitHub, distributing potent malware such as SmartLoader and StealC to an unsuspecting global audience. These compromised repositories, which have collectively amassed an alarming number of downloads exceeding 14 million, represent a significant threat to individuals and organizations leveraging open-source code and increasingly, AI-driven development tools. The campaign’s innovation lies in its strategic exploitation of the burgeoning AI landscape, employing a novel technique dubbed "agentbaiting" to ensnare both human developers and emerging AI agents.

The "FakeGit" operation is not a nascent threat but rather an evolution of a previous campaign that previously disseminated Lumma Stealer malware. Cybersecurity firm Trend Micro has attributed this earlier iteration to a threat actor known as "Water Kurita," indicating a persistent and adaptive adversary. The recent shift in focus towards AI-related tools and services signifies a calculated move to broaden the attack surface and exploit the rapid adoption of artificial intelligence in software development and operational workflows.

The Genesis and Escalation of FakeGit

The infiltration of AI-focused content within the FakeGit campaign appears to have commenced around March, with a notable surge in April. Researchers at Island, an enterprise browser platform, observed the creation of approximately 300 GitHub repositories specifically designed to mimic AI tools and services. This strategic pivot rapidly expanded, with FakeGit eventually encompassing over 1,400 repositories that masqueraded as AI tools, agents, and workflows. Each of these repositories was meticulously crafted to lead unsuspecting users to download SmartLoader or the StealC information stealer.

A significant portion of these malicious repositories, exceeding 800 in number, specifically targeted the AI community by pretending to be AI skills or Machine Configuration Protocol (MCP) servers. This deliberate targeting amplified their reach, as these repositories appeared over 600 times in public AI registries and catalogs. This tactic, termed "agentbaiting" by researchers, was designed to increase the repositories’ visibility to automated AI agents and developers actively searching for AI-related resources. The underlying hypothesis is that AI agents, when parsing the content of these repositories, would interpret the deceptive documentation as legitimate and potentially recommend them to human operators.

Deceptive Tactics and the "Agentbaiting" Technique

The success of FakeGit hinges on its elaborate deception. Many of the malicious repositories are expertly crafted to impersonate popular consumer and enterprise applications and services. This includes well-known platforms such as Gmail, WhatsApp, Databricks, Jenkins, and Docker. The threat actors have gone to great lengths to lend an air of legitimacy to their creations. This includes the inclusion of convincing documentation, the fabrication of impressive star and fork counts (key social proof metrics on GitHub), the replication of genuine project descriptions, and even the use of real developer account names.

The primary vector for malware delivery is embedded within the README files of these repositories. These files, often the first point of interaction for users, contain malicious links that direct visitors to download ZIP archives. These archives are presented as legitimate installers or project releases, but in reality, they contain disguised Lua payloads. Upon execution, these payloads initiate the SmartLoader malware.

The "agentbaiting" technique represents a sophisticated evolution in malware distribution. In a typical scenario, AI coding assistants or AI-powered search engines, when prompted with tasks related to AI development or integration, would likely scan and process the content of these repositories. The meticulously crafted README files, filled with technical jargon and seemingly legitimate project details, are designed to fool these AI agents into believing the repository is a genuine and valuable resource. Island’s research indicated that prominent AI models like ChatGPT, Gemini, and Claude surfaced various malicious repositories when queried with related tasks, and in some instances, even relayed the deceptive installation instructions.

The penetration of FakeGit into the AI ecosystem is further evidenced by its presence in public registries and catalogs. Island researchers identified over 600 listings for skills and MCP servers that were directly linked to the FakeGit campaign across platforms such as LobeHub, Glama, MCP.so, and MCP Market. This indicates that the operation has not only poisoned public resources but has also successfully integrated itself into the broader AI development infrastructure, making discovery and mitigation significantly more challenging. While the method of submission – manual or automated indexing – remains unclear, the widespread presence of these malicious listings undeniably enhances the discoverability and perceived credibility of the compromised repositories.

The Malware Payload: SmartLoader and StealC

Once the initial Lua payload executes, SmartLoader establishes persistence on the victim’s system. It achieves this through the creation of scheduled tasks, a common technique used by malware to ensure its continued operation even after system reboots. The command-and-control (C2) infrastructure for SmartLoader is particularly noteworthy. Instead of relying on traditional DNS or IP addresses, it retrieves its C2 address through a Polygon smart contract. This blockchain-based approach offers a degree of obfuscation and resilience, making it harder for security researchers to track and disrupt the malware’s communication channels.

Following successful C2 communication, SmartLoader proceeds to download additional encrypted stages of the attack directly from GitHub. This multi-stage approach allows for a more modular and adaptable infection process. The ultimate objective of this chain of events is the deployment of the StealC information stealer. StealC is a potent piece of malware designed to exfiltrate sensitive data from infected systems. This can include credentials, financial information, personal identifiable information, and other critical data that can be monetized by the attackers or used for further malicious activities. Recent enhancements to StealC have reportedly focused on stealth upgrades and expanded data theft capabilities, making it an even more formidable threat.

Controlled Testing and Potential Detection

Island’s research team conducted limited, controlled testing to assess the efficacy of AI agents in identifying and mitigating these threats. In one test scenario, the Claude Code agent cloned a malicious repository and downloaded the associated malicious files onto a test machine. While the agent initially proceeded with the download, it subsequently detected suspicious indicators and halted the execution process before any actual harm could be done.

However, it is crucial to note that these tests were not designed to establish a definitive detection rate. Therefore, they cannot provide conclusive evidence on whether coding agents can consistently identify and neutralize such threats during the execution phase. The findings suggest a nascent capability within some AI agents to detect malicious activity, but the sophistication of the FakeGit campaign and the adaptive nature of threat actors mean that this detection capability is likely to be a continuous arms race. The possibility remains that as AI agents improve, so too will the methods employed by attackers to evade them.

Quantifying the Impact and Broader Implications

The sheer scale of the FakeGit operation is staggering. GitHub’s public download counters for 335 unique Release assets across 211 FakeGit repositories recorded a cumulative total of 14,084,688 download events. Oleg Zaytsev, Lead Security Researcher at Island, cautioned that this figure includes repeated requests and automated activity, and therefore should not be directly interpreted as the number of successful infections. Nevertheless, the magnitude of downloads underscores the widespread reach of this campaign and the potential for a significant number of compromised systems.

The implications of the FakeGit campaign extend far beyond individual infections. The successful infiltration of AI ecosystems and the poisoning of public resources pose a significant risk to the integrity and security of AI development. As organizations increasingly rely on AI tools and open-source components, the threat of supply chain attacks, where malicious code is introduced through trusted third-party software, becomes ever more pronounced. The FakeGit campaign serves as a stark reminder that even seemingly innocuous code repositories can harbor significant dangers.

The use of "agentbaiting" also highlights a new frontier in cyber warfare, where attackers are actively seeking to exploit the capabilities of artificial intelligence for their malicious purposes. This necessitates a corresponding evolution in defensive strategies, focusing on enhancing the security awareness and detection capabilities of AI agents themselves.

Recommendations and Mitigation Strategies

In light of the significant threat posed by FakeGit and similar operations, Island has provided several key recommendations for organizations:

• Maintain Approved Catalogs: Organizations should establish and rigorously maintain approved catalogs of trusted AI skills and MCP servers. This helps to ensure that only vetted and secure components are integrated into development and operational workflows.
• Test New Capabilities in Isolated Environments: Any new AI tools, libraries, or code snippets should be thoroughly tested in isolated, sandboxed environments before being deployed into production systems. This prevents potential malware from spreading within the broader network.
• Verify Publishers and Repositories Independently: Developers and security teams must exercise due diligence in verifying the authenticity of publishers and the integrity of code repositories. This includes scrutinizing project descriptions, commit history, and community feedback.
• Immediate Rotation of Secrets: In instances where SmartLoader execution is suspected, all secrets (such as API keys, passwords, and authentication tokens) on impacted environments should be rotated immediately. This limits the potential damage that could be caused by compromised credentials.

The FakeGit campaign represents a significant advancement in the tactics, techniques, and procedures employed by cyber adversaries. Its successful exploitation of the burgeoning AI landscape and its innovative use of "agentbaiting" demand a proactive and adaptive response from the cybersecurity community. As AI continues to permeate every facet of technology, the threat of sophisticated attacks leveraging these powerful tools will only grow, necessitating a constant evolution of defensive strategies to stay ahead of the curve. The ongoing battle to secure the digital frontier will increasingly involve understanding and mitigating threats that are not only designed by humans but are also potentially amplified by artificial intelligence itself.