The Point: Nearly 7,600 malicious GitHub repositories lure developers and AI systems with fake AI integration tools and MCP servers to install SmartLoader malware.
Security firm Island has uncovered a large-scale campaign called FakeGit that distributes the SmartLoader malware through fake GitHub repositories and also uses autonomous AI agents as attack vectors.
Island analysts identified approximately 7,600 malicious GitHub repositories created by around 6,600 different profiles. Over 800 of these repositories impersonate interfaces for AI functions or Model Context Protocol (MCP) servers — focusing on integration scenarios such as Gmail, WhatsApp, and tools for Databricks, Jenkins, and Docker. Through July 2026, attackers demonstrated at least 14 million downloads of file attachments across approximately 200 of the repositories. Additionally, over 600 fake entries were placed in public MCP and skill registries such as LobeHub, Glama, MCP.so, and MCP Market.
The infection chain begins with ZIP files executed encrypted via the LuaJIT runtime environment. The first-stage script downloads SmartLoader, which in turn installs additional malware such as StealC — a data theft tool that exfiltrates system and login credentials. The fake repositories use copied original projects, impersonated developer profiles, and convincingly formatted README files to make the deception credible.
Particularly critical for CISOs: The campaign leverages “AgentBaiting,” where autonomous AI agents such as Claude Code (Anthropic), Gemini (Google), and ChatGPT (OpenAI) automatically search for matching tools or MCP servers, find the fake repositories, and trigger installation instructions without human validation. The AI systems interpret the manipulated README files as legitimate setup documentation and relay the attacker instructions directly — without any developer review.
Source: www.it-daily.net · Published 22 July 2026
Lumi AI News — AI-assisted curation in accordance with Art. 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.