FakeGit Campaign Floods GitHub with Thousands of Malicious Repos, Deploying SmartLoader Malware

On July 21, 2026, security researchers from the Island team published a deep‑dive into what they’re calling the “FakeGit” campaign. In plain English, the attackers have turned GitHub into a sprawling junkyard of fake projects – roughly 7,600 of them – and used these bogus repos to serve up the SmartLoader loader and its companion stealer, StealC.

What makes the operation unsettling isn’t just the sheer volume of repositories. Over 800 of those repos were deliberately crafted to look like AI‑related “skills” or “MCP” servers. They even managed to appear more than 600 times in public AI registries, meaning that when a developer asks an AI assistant for a code snippet, the assistant could casually suggest one of these malicious projects.

The researchers gave the technique a name: AgentBaiting. In a nutshell, the attackers sprinkle tantalising keywords throughout the repository metadata – think “ChatGPT plugin,” “Docker helper,” or “Jenkins pipeline” – hoping that large‑language‑model assistants will surface the repo in their suggestions. In controlled tests, popular agents like Claude, Gemini, and ChatGPT all listed at least one of the counterfeit repos when prompted.

From a technical standpoint, the malicious repos are convincing enough to fool a casual glance. They copy the look‑and‑feel of legitimate tools (Gmail, WhatsApp, Databricks, you name it), boast fake star counts, and even use real developer account names. Inside the README you’ll find a link to a ZIP file that, when unpacked, drops a Lua script. That script bootstraps SmartLoader, which then reaches out to a Polygon smart‑contract for its command‑and‑control address before pulling down the StealC payload.

SmartLoader isn’t a one‑off downloader; it establishes persistence via scheduled tasks, communicates with a hidden C2 server, and can fetch further encrypted stages from GitHub itself. In the end, the victim’s system ends up running StealC – a fairly classic information‑stealer that harvests credentials, browser data, and other juicy bits.

Numbers help put the scale into perspective. The team recorded more than 14 million cumulative download events across 335 unique release assets – though they stress that this figure includes repeat and automated requests, so it doesn’t equal 14 million infections. Still, it’s a stark reminder of how easy it is to weaponise a platform that hosts open‑source code.

Trend Micro, which previously linked the operation to the “Water Kurita” group – a name they’ve attached to a handful of earlier campaigns – corroborated the attribution. Island’s lead researcher, Oleg Zaytsev, said the campaign appears to be an evolution of the earlier “Lumma Stealer” infrastructure, simply repackaged for an AI‑driven world.

What can developers do about it? The report recommends treating any AI‑suggested code with a healthy dose of scepticism, verifying the source of a repository, and—if possible—pinning dependencies to known good versions. And, as a final note, keep an eye on your CI/CD pipelines; a rogue GitHub Action could be the next vector for this kind of attack.