FakeGit Campaign Exploits AI Agents via 7,600 Malicious GitHub Repositories to Deliver SmartLoader Malware

Executive Summary

Encrygma Intelligence has monitored a massive infrastructure-driven campaign codenamed "FakeGit," which has weaponized the growing ecosystem of Model Context Protocol (MCP) servers and AI-integrated developer tools. Since its discovery on July 20, 2026, researchers at Island Security have identified over 7,600 malicious GitHub repositories designed to deceive both human developers and autonomous AI agents. The campaign utilizes a new malware family known as SmartLoader to establish persistence and deploy high-impact secondary payloads, primarily the StealC information stealer.

Threat Analysis

The FakeGit operation represents a significant evolution in social engineering, introducing a technique dubbed "AgentBaiting." As organizations increasingly deploy autonomous AI agents to automate coding tasks, fetching dependencies, and configuring environments, threat actors have adapted by creating "agent-optimized" lures. These include README files and repository metadata specifically structured to rank highly in AI-driven searches. When an AI agent (such as Claude Code, Gemini, or ChatGPT-based IDE plugins) searches for a specific skill or integration, it inadvertently surfaces and executes the malicious setup scripts found in these repositories, bypassing traditional human skepticism.

Technical Details

The attack chain begins when a user or AI agent interacts with a trojanized repository. These repos often impersonate popular integrations for Gmail, WhatsApp, Databricks, and Docker. The primary delivery mechanism is a malicious ZIP file masquerading as a project asset or configuration package.

Once executed, the SmartLoader malware performs several environment checks to detect sandboxing or virtualization. If the environment is deemed suitable, it establishes a foothold and communicates with a decentralized C2 infrastructure. SmartLoader's primary function is to serve as a conduit for StealC, an advanced infostealer capable of harvesting browser credentials, session tokens, cryptocurrency wallets, and sensitive system telemetry. Notably, the campaign has recorded over 14 million downloads across approximately 200 high-traffic campaign repositories, indicating a highly successful distribution model.

Attribution Assessment

While no specific nation-state actor has been definitively linked to FakeGit, the sheer scale and automation of the infrastructure—comprising over 6,600 unique GitHub profiles—suggest a well-funded cybercriminal syndicate or a state-sponsored entity focused on industrial espionage. The operational tradecraft, particularly the use of lookalike developer profiles and continuously refreshed repository assets, shares tactical similarities with recent "Salt Typhoon" activity, though the current objective appears more aligned with broad data harvesting than targeted critical infrastructure disruption.

Implications

The FakeGit campaign highlights a critical blind spot in the modern software supply chain: the trust placed in autonomous agents. As these agents gain the ability to commit code and manage secrets, the risk of "Agent-in-the-Middle" attacks increases exponentially. The shift from targeting humans to targeting the tools humans use for automation marks a new frontier in initial access operations. Organizations must now consider the security posture of the AI models and agentic frameworks they integrate into their development lifecycles.

Recommendations

To mitigate the risk posed by SmartLoader and AgentBaiting, Encrygma recommends the following actions:

• Repository Pinning: Enforce strict controls on which GitHub repositories AI agents are permitted to access, utilizing allow-lists for verified enterprise accounts.
• Agent Sandboxing: Execute autonomous agents in isolated, containerized environments with no direct access to production secrets or primary network segments.
• Signature Monitoring: Update EDR/XDR signatures to detect the unique behavioral patterns of SmartLoader, specifically its use of encoded ZIP extraction within standard dev tool directories.
• Token Rotation: Conduct a proactive rotation of all application and cloud service tokens if any unauthorized GitHub repository interaction is detected in developer logs.