Malware no longer fools you: it fools your AI. FakeGit and its 7,600 fake GitHub repositories

We've spent twenty years teaching people not to run the email attachment. Training courses, phishing drills, posters by the coffee machine. And just as it was starting to work, attackers found a new user who never took any of those courses, works around the clock and executes whatever it reads without raising an eyebrow: your AI assistant. The FakeGit campaign, uncovered this week, seeded GitHub with 7,600 fake repositories; roughly 200 of them alone account for over 14 million malware downloads. And what strikes us as the real story isn't the number: it's that more than 800 of those repositories posed as MCP servers and AI skills, planted exactly where agents go looking, so the AI itself would find them and recommend them. Researchers have given it a name: agentbaiting.

What FakeGit is, in cold numbers

The numbers, according to Island's research (with earlier findings from Straiker AI and Derp.ca) and coverage by BleepingComputer and Help Net Security: some 6,600 fake GitHub profiles created close to 7,600 repositories mimicking legitimate projects —integrations for Gmail, WhatsApp, Databricks, Jenkins and Docker, among others—, with convincing READMEs and releases packaged like real software. Roughly 200 campaign repositories alone recorded over 14 million download events for their release assets. A download event is not a victim —there will be bots, retries and curious onlookers in there—, but as an entry funnel it's enormous.

The technical chain is modern-textbook stuff: the README points you to a ZIP, the ZIP carries a LuaJIT loading chain with an obfuscated Lua script, and that script deploys SmartLoader, a loader that persists via scheduled tasks and —a very 2026 touch— retrieves its C2 addresses by reading smart contracts on Polygon. From there it downloads the main course: StealC, an infostealer that grabs credentials, active sessions and other sensitive material from the machine. Trend Micro attributes the operation to the actor it tracks as Water Kurita, a continuation of an earlier campaign that distributed Lumma Stealer.

So far, a familiar scheme with good production values. What changes the movie is the next chapter.

Agentbaiting: social engineering is no longer (just) aimed at people

Of the 7,600 repositories, more than 1,400 targeted AI tools and workflows, and more than 800 posed as AI Skills or MCP servers — the pieces that connect assistants like Claude or ChatGPT to external tools. The campaign didn't stop at GitHub: researchers found over 600 listings on public MCP and skill registries (LobeHub, Glama, MCP.so, MCP Market) — the very catalogues where agents and their users go shopping for new capabilities.

And it works. Island tested it against the big three: Claude Code, Gemini and ChatGPT surfaced malicious campaign repositories in their answers without anyone showing them a link. In one test they asked for a free Walmart MCP server, and Gemini and ChatGPT recommended the same malicious repository as their top pick. The researchers' own phrase sums it up better than we could: the agent doing the search becomes the target, standing in for the person it works for.

Why this is a business problem, not a developer anecdote

Think about which machine all of this happens on. A developer's workstation —or a sysadmin's, or anyone's who uses an AI assistant with tool access— is one of the juiciest endpoints there is: repository credentials, open cloud sessions, API tokens, SSH keys, CI/CD access. StealC specialises in exactly that: credentials and active sessions. And what happens when valid credentials fall into hostile hands requires no imagination: we covered it just yesterday with the wiping of Romania's land registry, where the attacker didn't need a single exploit.

There's also a sign-of-the-times effect worth saying out loud: 2026 is the year everyone is installing MCP servers and skills at fever pitch. Every week a new integration promises to connect your assistant to your email, your ERP or your WhatsApp, and the pressure to try it is enormous. Attackers haven't discovered a vulnerability in AI: they've discovered that the distribution channel for AI capabilities still lacks the controls that "normal" software took twenty years to earn — signing, catalogues, review, reputation. The campaign, by the way, peaked in April 2026: this isn't a warning about the future, it's been happening for months.

What to do (and no, the answer is not banning AI)

The easy way out would be to end with "distrust AI". That's not our position: we work with automation and AI daily, and two days ago we wrote about how to build AI agent projects that survive. The answer isn't banning: it's treating MCP servers and skills as what they are —third-party software with privileged access— and applying the controls we already know how to apply.

At everyWAN we work this from both sides: the managed cybersecurity side —EDR/MDR watched 24/7, network visibility— and the AI automation side, where agent governance —what they can install, what they can touch, with which credentials— has to be part of the design, not a patch bolted on later. If you're bringing tool-wielding assistants into your company and nobody has yet decided who approves an MCP server, that conversation comes before the next integration: let's talk.

In short

For two decades, the first line of defense was teaching the human to be suspicious. FakeGit shows attackers are now grooming the trust of a second user: one that reads fast, doesn't look at the stars and executes with your credentials. The good news is the defenses don't need inventing: catalogue, sandbox, EDR, network visibility and a response script. The bad news is they need applying to a channel —AI capabilities— where today almost nobody applies them. Fourteen million downloads say the attackers have already done their share of the work. Ours is still pending.

Sources (verified): Island's research on FakeGit and agentbaiting (6,600 accounts, 800+ fake MCP/skills, 600+ listings on public registries, tests with Claude Code/Gemini/ChatGPT, the 67,000-star vs 63-star repository, April 2026 peak) — Help Net Security (Jul 21, 2026); 7,600 repositories, over 14 million download events across roughly 200 repositories, persistence via scheduled tasks, C2 via Polygon smart contracts, impersonation of Gmail/WhatsApp/Databricks/Jenkins/Docker and Trend Micro's attribution to Water Kurita — BleepingComputer; ZIP → LuaJIT → obfuscated Lua → SmartLoader → StealC chain — The Hacker News.