AgentBaiting: How Fake AI Skills Deliver Malware at Scale

-->

Solutions

Partners

Learn

About

Download

Schedule a demo

Log in

Schedule a demo

Back to blog

min read

July 20, 2026<br>Updated:

AgentBaiting: How 800+ Fake AI Skills and MCP Servers Delivered Malware<br>Security Research

Artificial Intelligence/ AI

Enterprise security

Inside the 7,600-repository FakeGit operation that brought SmartLoader into the AI capability supply chain, using GitHub repositories, public AI registries, and agent-readable instructions to create a new enterprise attack surface.

Oleg Zaytsev, Lead Security Researcher

TL;DR<br>Island security research uncovered about 7,600 malicious GitHub repositories, with more than 800 of them posing as AI Skills or MCP servers in a wave that peaked in April 2026. Those AI capability repositories appeared more than 600 times across public AI registries and catalogs, while the wider FakeGit operation recorded more than 14 million measured downloads.<br>FakeGit uses copied projects, lookalike developer profiles, convincing READMEs, and malicious ZIP files to deliver SmartLoader malware. Once executed, SmartLoader establishes persistence and installs StealC, an information stealer targeting credentials, active sessions, and other sensitive data.<br>The most significant shift is a technique we call AgentBaiting. An AI agent searching for a new capability such as a Skill or an MCP server can discover a campaign repository on its own, treat the attacker's README as legitimate documentation, and hand the installation instructions to the user. In our testing, Claude Code, Gemini, and ChatGPT all surfaced malicious campaign repositories without ever being shown a link. A playbook built to deceive people now deceives the agents acting on their behalf.<br>SmartLoader has entered the AI capability supply chain<br>For years, FakeGit and SmartLoader have targeted developers through convincing GitHub projects that turn software discovery into malware delivery. In the latest wave we observed, the campaign expanded into the AI capability ecosystem, presenting malicious repositories as Skills and MCP servers and gaining exposure through public AI registries. This brought an established malware operation into the workflows people and agents use to discover and install new AI capabilities.<br>Our investigation confirmed roughly 7,600 malicious GitHub repositories , created by about 6,600 profiles, including about 1,400 tied to AI tools, agents, or workflows. Over 800 posed as Skills or MCP servers spanning individual and enterprise use, from Gmail and WhatsApp integrations to Databricks, Jenkins, and Docker tooling.<br>The repository count tells only part of the story. We measured more than 14 million downloads across GitHub Release assets in about 200 campaign repositories as of July 2026, while thousands of other repositories embedded malicious ZIP files directly in the project, where downloads are not publicly counted.

Figure 1 : The scale of the FakeGit operation, including its AI-related repositories, Skills and MCP servers, and appearances across public AI registries.Within that broader operation, the latest AI wave developed quickly. GitHub creation dates show it building through March and peaking in April 2026, when nearly 300 AI-related repositories were created.

Figure 2 : Monthly creation dates for accessible FakeGit repositories, showing the AI-themed wave peaking in April 2026.The repositories were designed to meet demand already forming around AI capabilities, borrowing the names and workflows of familiar consumer and enterprise tools. That familiarity gave the malicious ZIP files a credible reason to be downloaded, while the README guided users or agents from what appeared to be routine setup into the SmartLoader attack chain.<br>FakeGit and SmartLoader: How the attack works<br>FakeGit builds credibility one layer at a time. It copies or fabricates projects, places them under convincing developer identities, and uses their READMEs to make malware execution look like a routine installation.<br>Mann1988/awesome-claude-skills copied the name and positioning of the original ComposioHQ/awesome-claude-skills, a widely used collection with more than 67,000 stars and 7,600 forks. The fake repository had accumulated 63 stars and 18 forks of its own, enough to appear established at a glance. Its README then presented awesome-skills-claude-3.3.zip, a confirmed SmartLoader package, as the project’s download.

Figure 3: The fake Mann1988/awesome-claude-skills repository imitates the original ComposioHQ/awesome-claude-skills project while directing visitors to a SmartLoader download.The deception also extends to the profiles behind the projects. The campaign account Naveenkm007 differs by one character from established developer Naveenkm07 and closely mirrors the original profile. It then uses that identity to publish Naveenkm007/spaceship-mcp, an MCP server containing a confirmed SmartLoader package.

Figure 4: Comparison of...