Threat · curated 20 Jul 2026
AgentBaiting: How Fake AI Skills Deliver Malware at Scale
First reported island.io
Coverage timeline
Single-source incident — first reported, latest, and curated coincide.
Why it matters
FakeGit weaponizes the AI capability supply chain by seeding fake MCP servers and AI Skills that AI coding agents surface and recommend on their own, turning agent-assisted software discovery into a malware delivery vector for enterprises.
Island security researchers uncovered the FakeGit campaign, which used roughly 7,600 malicious GitHub repositories—over 800 posing as AI Skills or MCP servers—to deliver SmartLoader malware that installs the StealC information stealer. The campaign introduces a technique called AgentBaiting, in which AI agents such as Claude Code, Gemini, and ChatGPT autonomously discover the attacker repositories, treat the malicious README as legitimate documentation, and pass installation instructions to users; the operation recorded over 14 million downloads.
Summary
Island security researchers uncovered an ongoing campaign codenamed FakeGit comprising nearly 7,600 malicious GitHub repositories, more than 800 of which impersonate AI Skills or Model Context Protocol (MCP) servers to deliver the SmartLoader malware family. The AI-themed wave peaked in April 2026 and, across roughly 200 campaign repositories with publicly counted GitHub Release downloads, has recorded more than 14 million downloads as of July 2026.[0][8]
The operation weaponizes copied projects, lookalike developer profiles, convincing READMEs, and malicious ZIP files. Once SmartLoader executes, it establishes persistence and installs StealC, an information stealer that harvests credentials, active sessions, and other sensitive data from compromised systems.[0][8]
The defining escalation is a technique Island calls AgentBaiting: an AI agent searching for a new Skill or MCP server can discover a FakeGit repository on its own, treat the attacker's README as legitimate documentation, and hand the installation instructions to the user without a human ever being shown a malicious link. In testing, Claude Code, Gemini, and ChatGPT all surfaced malicious campaign repositories, extending a social-engineering playbook built for humans to the agents acting on their behalf.[0][8]
Attack chain
- Staging / Lure creation: Attackers create nearly 7,600 malicious GitHub repositories using about 6,600 lookalike developer profiles, with over 800 posing as AI Skills or MCP servers mimicking familiar consumer and enterprise tools (Gmail, WhatsApp, Databricks, Jenkins, Docker). Repositories are either fabricated or copied from legitimate projects and paired with convincing READMEs.[0][8]
- Distribution / Discovery: Campaign repositories are amplified through public MCP and Skill registries such as LobeHub, Glama, MCP.so, and MCP Market, lending false legitimacy. Under AgentBaiting, an AI agent (Claude Code, Gemini, ChatGPT) can surface these repositories on its own from a benign prompt without being shown any link, then relay the attacker's README instructions to the user.[0][8]
- Delivery / Execution: The README guides the user or agent from apparent routine setup into downloading a malicious ZIP archive, which triggers a LuaJIT loader chain that executes an obfuscated Lua script responsible for dropping SmartLoader.[0]
- Persistence and secondary payload: SmartLoader establishes persistence and deploys StealC, an information stealer that harvests credentials, active sessions, and a wide range of sensitive data from the compromised system.[0][8]
Disclosure timeline
| Date | Event |
|---|---|
| Earlier in 2026 (February) | Straiker AI flags the use of trojanized MCP servers to distribute SmartLoader and StealC, later corroborated by Derp.ca.[0] |
| March–April 2026 | The AI-themed FakeGit wave builds through March and peaks in April 2026, with nearly 300 AI-related repositories created that month.[8] |
| July 2026 | Island measures more than 14 million downloads across about 200 campaign repositories and publishes the AgentBaiting research; The Hacker News reports on it July 20, 2026.[0][8] |
Actor profile
FakeGit
FakeGit is the codename for a long-running operation that turns software discovery into malware delivery, historically targeting developers through convincing GitHub projects. In its latest wave it expanded into the AI capability ecosystem, presenting malicious repositories as Skills and MCP servers to deliver SmartLoader and StealC. The evidence describes it as a campaign and delivery operation rather than attributing it to a named threat group; Island notes it did not need to breach anything, instead relying on convincing repositories, borrowed identities, registry listings, and discovery to reach victims.[0][8]
How it works
The delivery mechanism abuses trust in software and AI-capability discovery rather than a software flaw. Counterfeit repositories act as a conduit for a ZIP archive that triggers a LuaJIT loader chain, leading to execution of an obfuscated Lua script that drops SmartLoader, which then deploys StealC.[0]
AgentBaiting exploits AI agents' automated discovery behavior: an agent looking for a Skill or MCP server can locate a FakeGit repository without being given a link, treat the malicious README as legitimate documentation, and carry the attacker's instructions forward to the user. Island demonstrated this against Claude Code, Gemini, and ChatGPT using benign-looking prompts such as requests to find a free Claude skill or a free Walmart MCP server link.[0][8]
Key takeaways
- An established malware operation (FakeGit/SmartLoader) has moved into the AI capability supply chain, weaponizing the workflows people and agents use to discover and install AI Skills and MCP servers.[0][8]
- AgentBaiting shows that social-engineering lures designed for humans can now equally deceive AI agents, which can autonomously surface malicious repositories and pass attacker instructions forward without a human ever seeing a link.[0][8]
- Public AI and MCP registries amplify the threat by lending false legitimacy to malicious listings, making publisher/project verification and vetted capability catalogs essential defenses.[0]
Defensive actions
- Build and maintain a catalog of reviewed Skills, MCP servers, and agent plugins.: A vetted allowlist interrupts the discovery-to-execution chain that FakeGit and AgentBaiting depend on, preventing unreviewed AI capabilities from being installed.[0]
- Evaluate new agent capabilities in a sandboxed environment before broader rollout.: Sandboxing new Skills or MCP servers contains the LuaJIT loader chain and SmartLoader/StealC execution before it can reach production systems.[0]
- Verify both the publisher and the project before installation.: FakeGit relies on lookalike developer profiles, copied projects, and registry listings to fabricate credibility, so verifying publisher and project identity counters the impersonation.[0]
- Monitor agentic pathways.: Because AgentBaiting lets AI agents discover and relay malicious repositories without human involvement, monitoring agent discovery and installation activity is needed to interrupt the chain before execution.[0]