In short: Researchers uncovered a large campaign, codenamed FakeGit, that seeded about 7,600 malicious GitHub repositories from roughly 6,600 accounts. More than 800 of them posed as "AI skills" or MCP servers, and by July 2026 the fake files had racked up over 14 million downloads. The twist: the repositories are baited not only for humans but for AI assistants — tests showed ChatGPT, Google Gemini and Claude Code could recommend the poisoned projects on their own. The payload, SmartLoader, quietly installs the StealC infostealer to grab passwords, cookies, sessions and crypto wallets. The defense is old-school: verify the real source, don't run random builds, and use a password manager with two-factor authentication.
What happened?
In July 2026 security researchers at Island published an analysis of a long-running operation they call FakeGit. The operators flooded GitHub with roughly 7,600 bogus repositories tied to about 6,600 accounts. Around 1,400 of those accounts were dressed up as AI tools, agents or workflows, and over 800 repositories explicitly pretended to be "AI skills" or Model Context Protocol (MCP) servers — plug-ins that AI assistants can use to extend their abilities.
To look convincing, the crooks copied real open-source projects, cloned developer profiles and wrote polished README files. Each repo carried a malicious ZIP in its "Release" assets. This is the same trust-abuse pattern we described in our report on fake download sites spreading remote-access trojans — only now the storefront is GitHub itself. If you want the basics of staying safe online, start with our blog.
What is "AgentBaiting"?
The genuinely new element is a technique researchers named agentbaiting. Classic malware lures are written for a human who is searching, reading and clicking. AgentBaiting is written for the AI assistant that does the searching. When a chatbot or coding agent looks for a skill or an MCP server to solve a task, it can stumble onto one of these fake repositories and act on it automatically — no human ever sees or approves a link.
According to the research, the fake projects appeared more than 600 times inside public AI registries and catalogs, and lab tests found that Anthropic Claude Code, Google Gemini and OpenAI ChatGPT could all surface the malicious repositories without being shown a link first. In other words, the very convenience of "ask the AI to find me a tool" became the delivery channel.
What the malware does to your data
Open one of these ZIPs and you run SmartLoader — a loader whose job is to pull down further modules on command. In this campaign it installs StealC, a well-known infostealer. StealC harvests saved passwords, browser cookies and active login sessions, access tokens and cryptocurrency wallets, then ships them to the attacker. Stolen session cookies are especially nasty because they can let a criminal log in as you without your password, sometimes even past two-factor authentication. It is the same class of theft we covered in the giant infostealer password leak.
Researchers link FakeGit to earlier Lumma stealer activity attributed to a threat actor tracked as Water Kurita, suggesting this is a professional, evolving operation rather than a one-off.
What it means for regular users
You do not have to be a programmer to be exposed. As more people ask AI assistants to "find an app," "write me a script" or "set up a tool," the answer increasingly comes from public code repositories. If the assistant points you to a poisoned project and you run it, the infostealer lands on your machine — and everything it steals (passwords, sessions, wallets) is a privacy problem, not just a developer problem.
The wider lesson echoes other 2026 stories about attacks aimed at AI systems, such as data leaks through unsanctioned AI use: AI tools are now part of your attack surface, and their output needs the same skepticism you would give a random download.
How to protect yourself
Verify the real source. Before downloading code, check that the repository is the official one — look at the star count, history, the maintainer's other work and links from the project's own website. A shiny README and a familiar name are not proof.
Don't run AI-suggested tools blindly. Treat a repo an assistant recommends the way you would a link from a stranger: confirm it independently before you execute anything. Avoid downloading builds from Release ZIPs of unknown accounts.
Use a password manager and two-factor authentication. Unique passwords limit the damage if one set of credentials leaks, and app-based or hardware 2FA raises the bar even when a stealer grabs a password.
Protect the network layer. To be honest, a VPN cannot stop you from running a file you downloaded yourself — endpoint hygiene does that. But a VPN like LiMP VPN encrypts your traffic on untrusted networks and hides your real IP, reducing tracking and interception while you browse. See how it works on our features page, and pair it with the habits above.
Sources
This report is based on the original research by Island and coverage by BleepingComputer, The Hacker News and Russian-language Xakep (July 2026).