Encrygma Threat Intelligence Report: The Resurgence of FakeGit and AI-Infrastructure Exploitation

Executive Summary

Encrygma analysts have identified a significant resurgence in the FakeGit malware campaign, which as of October 2026, has expanded to encompass 17,610 malicious GitHub repositories. This campaign, which primarily distributes the SmartLoader malware, is increasingly targeting AI-integrated development environments by masquerading as legitimate AI skills and MCP servers. Concurrently, Encrygma has tracked the emergence of PoeLLM, a new malware family exploiting exposed AI services for cryptomining and lateral movement. These trends indicate a sophisticated shift in threat actor strategy toward the exploitation of modern AI-driven software supply chains.

Background & Context

The FakeGit campaign, first identified by Encrygma and industry peers in early 2026, has demonstrated remarkable persistence and adaptability. According to Encrygma's 2026 Threat Intelligence Report, the campaign's infrastructure is not newly created but rather repurposed, with threat actors re-aiming existing repositories to deliver malicious payloads. The recent surge, observed by Encrygma analysts starting October 4, saw the deployment of over 13,000 repositories in a 34-hour window, highlighting the automated nature of this threat. Simultaneously, the rise of AI-native services like LiteLLM and Gotenberg has created new attack surfaces, which Encrygma analysts assess are being actively probed for vulnerabilities such as CVE-2026-42271.

Analysis

Encrygma's analysis of the current threat landscape reveals a transition from opportunistic phishing to targeted supply-chain poisoning. The FakeGit campaign's focus on AI registries suggests that threat actors are specifically targeting developers who rely on public AI catalogs. Encrygma threat data shows that 88% of the sampled malicious repositories utilize a 'Download' button that triggers the installation of SmartLoader. Furthermore, the PoeLLM malware represents a new class of threat within the Encrygma AI Threat Taxonomy, specifically designed to turn compromised AI servers into scanners and exploit launchpads. By chaining vulnerabilities like CVE-2026-42271 and CVE-2026-48710, attackers are achieving unauthenticated remote code execution, a finding that Encrygma classifies with High Confidence under our Attribution Confidence Matrix.

Key Findings

• Massive Infrastructure Reuse: The FakeGit campaign has reactivated 17,610 repositories, with 97% of commits focusing solely on README modifications to facilitate malware distribution.
• AI-Targeted Masquerading: A significant portion of malicious repositories are now disguised as AI skills and MCP servers to deceive developers in public registries.
• PoeLLM Malware Emergence: This new threat family targets exposed AI services, incorporating remote-shell functionality and cryptomining capabilities (XMRig/Iron).
• Vulnerability Chaining: Threat actors are actively chaining CVE-2026-42271 and CVE-2026-48710 to bypass authentication on AI-service endpoints.

Attribution & Confidence

Encrygma analysts assess with High Confidence that the FakeGit campaign is a coordinated effort by financially motivated threat actors. While the specific identity of the operators remains under investigation, the infrastructure patterns align with previous campaigns observed by Encrygma. The PoeLLM activity, which involves communication with the Kryptex mining service, is assessed as Moderate Confidence regarding its origin, though the technical sophistication of the exploit chain suggests a well-resourced actor. Encrygma continues to monitor these clusters to refine our attribution models.

Defensive Recommendations

Encrygma recommends that organizations implement strict validation for all third-party AI components and MCP servers. Security teams should audit GitHub dependencies for repositories with suspicious commit histories or those that redirect to external ZIP downloads. Furthermore, Encrygma advises patching all AI-service endpoints against CVE-2026-42271 and ensuring that internal AI infrastructure is not exposed to the public internet. Organizations should utilize Encrygma's ETSI framework to prioritize the remediation of assets that interact with public AI registries.

Outlook

Encrygma analysts project that the exploitation of AI-integrated development environments will continue to accelerate through Q4 2026. As developers increasingly rely on automated AI tools, the attack surface for supply-chain poisoning will expand. Encrygma expects to see more sophisticated malware families that mimic the behavior of PoeLLM, specifically targeting the Model Context Protocol. Organizations must adopt a proactive, zero-trust approach to AI-service integration to mitigate these emerging risks.