FHN 
The growing adoption of AI assistants, Skills, and Model Context Protocol (MCP) servers has created a new attack surface for cybercriminals. Researchers have uncovered a large-scale campaign in which attackers are abusing GitHub repositories, AI capability registries, and trusted developer resources to distribute SmartLoader and StealC malware.
Unlike traditional malware campaigns that depend on phishing emails or fake software downloads, this operation targets both developers and AI assistants by poisoning the AI software supply chain. The technique, referred to as AgentBaiting, allows attackers to exploit the trust placed in public AI repositories and documentation, increasing the chances that malicious projects are recommended and installed.
Researchers identified approximately 7,600 malicious GitHub repositories operated by around 6,600 GitHub accounts. Among them, nearly 1,400 repositories were related to AI tools, agents, or automation workflows, while more than 800 repositories specifically impersonated AI Skills or MCP servers.
The campaign spans both personal and enterprise-focused AI tools, including Gmail automation, WhatsApp integrations, AI image generators, resume parsers, Docker connectors, Jenkins plugins, and Databricks integrations. Many of these repositories closely resemble legitimate open-source projects, making them difficult to distinguish from genuine software.
Researchers also observed more than 14 million GitHub Release downloads across approximately 200 campaign repositories. Popular fake projects attracted hundreds of thousands of downloads, while many additional repositories distributed malicious ZIP files directly within the repository itself, making the campaign’s actual reach significantly larger than publicly available download statistics suggest.
How the Attack Works
At the center of the campaign is SmartLoader, a malware loader previously associated with GitHub-based malware distribution. Attackers either clone legitimate repositories or create convincing fake projects that mimic trusted developer tools. These repositories are supported by professional-looking READMEs, fabricated contributor profiles, fake stars, forks, and other GitHub trust signals designed to increase credibility.
The malware installation process is disguised as a normal setup procedure. Downloaded archives typically contain launcher scripts, a LuaJIT-based runtime, and heavily obfuscated Lua payloads that eventually deploy StealC, a well-known information-stealing malware family.
Researchers noted that earlier SmartLoader campaigns had already abused trojanized MCP servers, including cloned Oura Ring integrations, to compromise developer environments. The latest campaign expands this strategy by targeting the rapidly growing AI ecosystem, where Skills, plugins, and MCP servers often receive broad trust without extensive security validation.
One of the most concerning aspects of the campaign is the use of AgentBaiting. Instead of convincing users through traditional phishing techniques, attackers manipulate AI assistants into recommending malicious repositories during legitimate searches.
Testing demonstrated that AI coding assistants and chat-based tools such as Claude Code, Gemini, and ChatGPT can automatically discover attacker-controlled Skills and MCP servers through public registries and GitHub searches. These AI systems may interpret attacker-written documentation as trustworthy installation guidance and present malicious repositories as recommended solutions.
For example, an AI assistant searching for a free cinematic prompt Skill or a free Walmart MCP server could legitimately encounter a malicious repository that has already been indexed by public registries. Since the repository appears authentic and contains convincing documentation, the AI assistant may recommend it without recognizing the underlying threat.
This represents a significant shift in attacker methodology. Rather than directly targeting users, attackers are increasingly influencing the recommendations generated by autonomous AI systems.
The campaign also abuses public AI capability registries that rely heavily on GitHub repositories as trusted sources. Researchers discovered more than 600 malicious listings across platforms including:
- LobeHub
- Glama
- MCP.so
- MCP Market
Many of these registries automatically republish GitHub READMEs and installation instructions, unintentionally amplifying malicious content and increasing its visibility among developers and AI agents.
Impact and Recommended Mitigations
After execution, SmartLoader establishes persistence on the infected system by creating scheduled tasks within the %LOCALAPPDATA% directory. It then retrieves additional encrypted payloads from GitHub and obtains its active command-and-control (C2) server information through values stored inside a Polygon blockchain smart contract, making infrastructure changes more difficult to detect.
The final payload, StealC, is a mature information stealer capable of collecting a wide range of sensitive information, including:
- Browser credentials
- Saved passwords
- Authentication cookies
- Active web sessions
- Email credentials
- Remote access credentials
- Cryptocurrency wallet data
- SSH keys
- Cloud credentials
- Developer secrets
- Host and system information
The campaign highlights a broader security challenge. AI Skills, MCP servers, plugins, and agent workflows are rapidly becoming part of enterprise environments, yet many traditional security solutions—including SIEM platforms, DLP tools, and vulnerability scanners—do not fully inventory or monitor these AI capabilities. As a result, organizations may have limited visibility into what AI assistants connect to or what permissions these integrations receive.
To reduce the risk of AgentBaiting attacks, organizations should treat AI capabilities as software supply chain components rather than simple productivity tools.
Security teams should consider the following best practices:
- Build internal catalogs of approved AI Skills, MCP servers, and plugins.
- Verify publishers instead of relying on GitHub stars, forks, or registry listings.
- Test newly introduced AI capabilities inside isolated environments.
- Reject AI tools distributed as executable files or ZIP archives without transparent source code.
- Monitor AI agent downloads, Git operations, and MCP configuration changes.
- Maintain an inventory of all approved AI repositories, versions, and file hashes.
- Continuously review AI integrations for newly identified malicious repositories.
- Restrict AI tools from accessing sensitive credentials until they have been properly validated.
The FakeGit campaign demonstrates that the AI software supply chain has become an attractive target for attackers. As organizations continue integrating AI assistants into development and business workflows, security teams must extend their software supply chain protections beyond traditional applications to include AI Skills, MCP servers, plugins, and agent-driven automation. Without stronger validation and monitoring, trusted AI ecosystems could become an increasingly effective channel for malware distribution and credential theft.
About the Author
