• 3 min read
7,600 fake GitHub repos spread SmartLoader malware
Researchers say the FakeGit campaign used 7,600 GitHub repos and 600+ AI registry listings to push SmartLoader and StealC malware.
Image: BleepingComputer
A malware operation dubbed FakeGit used 7,600 malicious GitHub repositories to distribute SmartLoader and StealC, according to researchers at enterprise browser company Island. The campaign racked up more than 14 million downloads, though the researchers and GitHub download counters do not equate that figure with confirmed infections.
The operation also leaned heavily into fake AI tools. More than 800 repositories posed as AI skills or MCP servers, and appeared over 600 times in public AI registries and catalogs. Island says that tactic boosts the odds that coding agents and developers will encounter the repos, a method the researchers call “AgentBaiting.”
The activity is seen as a continuation of an older campaign linked to Lumma Stealer and attributed by Trend Micro to a threat actor it tracks as “Water Kurita.”
Island says the AI-themed push began in March and peaked in April, when attackers created 300 GitHub repositories tied to AI tools. In total, researchers identified more than 1,400 repositories related to AI tools, agents, and workflows that pointed users to SmartLoader or StealC downloads.
Recommended reading
OpenAI test models breached Hugging Face systems
Many of the fake repos impersonated widely used services and developer tools including Gmail, WhatsApp, Databricks, Jenkins, and Docker. To appear legitimate, they used copied project descriptions, fake stars and fork counts, convincing documentation, and real developer account names.
The repos' README files directed visitors to ZIP archives presented as installers or releases. Those archives were actually disguised Lua payloads that launched SmartLoader. Once running, SmartLoader sets up persistence with scheduled tasks, retrieves its command-and-control (C2) address through a Polygon smart contract, and pulls additional encrypted payloads from GitHub before eventually deploying StealC.
How AgentBaiting worked
Island says the goal was not just to trick people directly, but to get malicious repos surfaced by coding agents. In a typical case, an agent may parse a README as if it were genuine documentation and then recommend the repository or its ZIP file to a user.
In Island’s testing, ChatGPT, Gemini, and Claude all surfaced various malicious repositories for related prompts, and in some cases passed along the installation instructions. The researchers also found more than 600 listings in public registries and catalogs tied to the campaign, including LobeHub, Glama, MCP.so, and MCP Market.
Island told BleepingComputer that in limited, controlled tests, Claude Code cloned malicious repositories and downloaded the malicious files to a test machine, but later detected suspicious indicators and stopped before execution. The researchers said the tests were not designed to measure detection rates or prove whether coding agents can reliably catch the threat during execution.
For the broader campaign, Island counted 14,084,688 cumulative download events across 335 unique Release assets in 211 GitFake repositories. Oleg Zaytsev, Lead Security Researcher at Island, said that total includes repeated requests and automated activity, so it should not be treated as an infection count.
Island recommends that organizations keep approved catalogs of skills and MCP servers, test new capabilities in isolated environments, independently verify publishers and repositories, and immediately rotate all secrets if SmartLoader execution is suspected.
Security Editor
Sophia unpacks the invisible wars happening on our networks. Covering cybersecurity, privacy legislation, and cryptography, she exposes how our data is weaponized and defended. Before joining for(geeks), she spent years as a penetration tester. She's the reason the rest of the team uses physical security keys.
via BleepingComputer
