Roughly 7,600 malicious GitHub repositories were uncovered, more than 800 of them posing as AI Skills or Model Context Protocol (MCP) servers, in a wave that peaked in April 2026, according to Island.
The scale of the FakeGit operation (Source: Island)
The fake repositories are tied to about 6,600 accounts, around 1,400 of which were built around AI tools, agents, or workflows, and span individual and enterprise use, ranging from Gmail and WhatsApp integrations to Databricks, Jenkins, and Docker tooling.
The campaign, codenamed FakeGit, delivers a malware family called SmartLoader and had logged more than 14 million downloads across GitHub Release assets in about 200 of these repositories by July 2026.
“FakeGit uses copied projects, lookalike developer profiles, convincing READMEs, and malicious ZIP files to deliver SmartLoader malware. Once executed, SmartLoader establishes persistence and installs StealC, an information stealer targeting credentials, active sessions, and other sensitive data,” said Oleg Zaytsev, lead security researcher at Island.
Straiker AI first flagged the use of trojanized MCP servers to spread SmartLoader and StealC earlier this year, with Derp.ca following up on the finding later.
AgentBaiting: Targeting AI agents instead of users
Within this operation, Island identified a technique it calls AgentBaiting, where the AI agent doing the search becomes the target, standing in for the person it works for.
“An AI agent searching for a new capability such as a Skill or an MCP server can discover a campaign repository on its own, treat the attacker’s README as legitimate documentation, and hand the installation instructions to the user,” Zaytsev noted.
Asked to find a free “cinematic prompt” skill, Claude Code found both a legitimate repository and a malicious one. It recommended the legitimate option but, in the same run, also passed along the malicious repository’s installation steps, telling the user to download an .exe and click past a Windows security warning. In other runs, it inspected the same repository more closely and refused to recommend it.
Gemini and ChatGPT had the same problem. Asked for a free Walmart MCP server, both recommended the same malicious repository as their top pick.
“In our testing, Claude Code, Gemini, and ChatGPT all surfaced malicious campaign repositories without ever being shown a link,” Zaytsev added.
These are not obscure, low-effort pages. One repository copies the name and layout of a legitimate project with over 67,000 stars, picking up 63 stars and 18 forks of its own, enough to look established at a glance.
“The deception also extends to the profiles behind the projects,” Zaytsev said. One account differs by one character from a known developer’s real handle and copies the profile closely before publishing its own malicious MCP server.
More than 600 listings for these repositories turned up on public AI registries, including LobeHub, Glama, MCP.so, and MCP Market. Some registries mirror the repository’s README directly, carrying the malicious download link onto another platform under that registry’s own credibility.
How enterprises can protect themselves
To counter the threat, Island advises building a catalog of reviewed Skills and MCP servers, testing new capabilities in a sandboxed environment first, verifying both the publisher and the project, and monitoring the paths agents use to download and install tools.
“If SmartLoader execution is suspected, isolate the endpoint and revoke active browser sessions, OAuth grants, API tokens, and cloud and developer credentials. StealC takes live sessions, not just passwords, so resetting passwords alone is not enough,” Zaytsev concluded.
Island included a list of affected repositories and file hashes alongside its report.
