FakeGit Turns AI Capability Discovery Into a Malware Delivery Channel

2026-07-22 Agent & Supply Chain Security by al-ice.ai Editorial

Island Security has mapped a large malware operation that treats AI capability discovery as a supply-chain entry point. Its researchers identified roughly 7,600 malicious GitHub repositories associated with about 6,600 profiles. More than 1,400 repositories were tied to AI tools, agents, or workflows, including over 800 that posed specifically as AI Skills or Model Context Protocol servers.

The repositories did not exploit an MCP protocol flaw. They used a more ordinary—and immediately actionable—path: copied projects, lookalike maintainers, plausible documentation, and downloadable Windows archives that installed SmartLoader. Island says the wider FakeGit operation recorded more than 14 million GitHub Release asset downloads across about 200 campaign repositories as of July 2026. That counter is a measure of asset downloads, not a verified count of infected people or endpoints.

The agent-security consequence is discovery automation. In Island’s tests, Claude Code, Gemini, and ChatGPT independently surfaced campaign repositories while answering ordinary requests for Skills or MCP servers. The company calls the technique “AgentBaiting”: attacker-controlled documentation is optimized not only to persuade a person, but also to become the source an agent selects and converts into installation guidance.

The README is both the lure and the agent instruction channel

FakeGit builds trust in layers. Campaign operators copied popular project names, created usernames differing by a character from established developers, added modest numbers of stars and forks, and wrote READMEs that framed execution as normal setup. One fake Skill collection imitated a legitimate repository with tens of thousands of stars; a separate lookalike developer profile published a bogus spaceship MCP server.

The malicious packages also fail a basic provenance test. Island examined a purported Databricks MCP server whose ZIP contained no server manifest or Databricks integration. It held a command launcher, a renamed LuaJIT-style runtime, and an obfuscated Lua payload disguised as a text file. The launcher simply passed that payload to the runtime.

Earlier reverse engineering by Derp.ca connects this package pattern to a longer-running FakeGit operation. Its March analysis found LuaJIT loaders resolving current command infrastructure through a value in a Polygon smart contract, establishing persistence with scheduled tasks, retrieving encrypted stages from GitHub, and ultimately delivering the StealC information stealer. StealC targets browser credentials, cookies, active sessions, extension data, remote-access credentials, screenshots, and host information.

Registries amplified repository credibility

Island found more than 600 listings for campaign-linked Skills and MCP servers across LobeHub, Glama, MCP.so, and MCP Market. The researchers could not determine whether every listing was submitted deliberately or indexed automatically. In some cases, however, a registry reproduced the repository’s README—including its download link and installation instructions—giving the same attacker-controlled text a second distribution surface.

This matters because agents and users can treat a catalog appearance as independent validation when it may be only a republished claim. A repository, a registry page, and an agent recommendation can look like three trust signals while all three derive from one hostile README.

The campaign also matched lures to real enterprise work. Island reports that 62% of the malicious Skill and MCP repositories were positioned for enterprise or internal-developer use, with themes including Databricks, Jenkins, Docker, Gmail, cloud services, databases, source code, and security tooling. The promised integration did not need the production access it advertised: executing the package compromised the workstation first, where browser sessions, developer tokens, cloud credentials, and source access could already be present.

Agent recommendations are discovery results, not attestations

Island asked Claude Code to find a free cinematic-prompt Skill. Claude reached both a legitimate project and a malicious alternative, then repeated the hostile repository’s instructions to download an executable and bypass a Windows warning. In other runs it inspected the contents more closely and refused. That inconsistency is the risk: successful rejection in one trace does not make autonomous open-web discovery a dependable software-verification control.

For a request seeking a free Walmart MCP server, Island says Gemini returned a confirmed campaign repository as its first recommendation. ChatGPT surfaced the same repository and identified it as the best starting point among three options. These tests demonstrate recommendation exposure, not automatic compromise by the models themselves; execution still depended on the package being downloaded and run.

The operational lesson extends beyond FakeGit. Agents are becoming package-discovery intermediaries, but generated rankings and summaries do not establish maintainer identity, artifact integrity, build provenance, or registry review. An agent that finds software should be treated like an untrusted search client unless a separate policy system verifies the result before installation.

Defensive engineering guidance

Replace open discovery with an approved capability catalog. Pin reviewed Skills, MCP servers, plugins, source repositories, commits, versions, and artifact hashes. Agents should resolve capabilities from that inventory rather than choose arbitrary public results.
Separate discovery from execution. Do not let the same agent search the web, accept a README’s claims, download a binary, and run it. Require deterministic checks and a separately authorized approval step before installation.
Reject executable-only “Skills” and “MCP servers.” A Windows ZIP containing a launcher, runtime, and obfuscated payload is not a credible substitute for inspectable source, a manifest, reproducible build information, and documented dependencies.
Verify publisher continuity. Compare account spelling, history, signing keys, organization membership, prior releases, and links from the vendor’s official domain. Stars, forks, profile age, and registry presence are weak signals and can be manufactured or inherited from a compromised account.
Quarantine first execution. Evaluate new capabilities in a disposable environment without browser profiles, SSH keys, cloud credentials, source repositories, production data, or unrestricted egress. Capture file, process, registry, scheduled-task, and network activity.
Monitor agent-originated software changes. Alert on agent-initiated downloads, clones, changes to Skill directories or MCP configuration, execution from extracted archives, and instructions to bypass operating-system reputation warnings.
Hunt with the published artifacts. Island released representative repository names and SHA-256 hashes in a public research-artifacts repository. Match them against endpoint, proxy, source-control, and download telemetry while recognizing that individual accounts and filenames may change.
Respond as session theft, not only password theft. If SmartLoader or StealC execution is suspected, isolate the endpoint and revoke browser sessions, OAuth grants, API tokens, cloud credentials, and developer keys. Password resets alone do not invalidate every stolen session.

FakeGit shows that the AI software supply chain begins before a package manager or protocol handshake. It begins when an agent decides which project deserves trust. Registries can multiply attacker-written metadata, and models can turn that metadata into concise setup steps. The durable defense is to make discovery non-authoritative: only verified publishers and pinned artifacts should cross from an agent’s research context into an executable environment.

Sources: