FakeGit is a large-scale operation of roughly 7,600 malicious GitHub repositories that disguise SmartLoader malware as ordinary software downloads, with over 800 posing as AI Skills or MCP servers; its AgentBaiting evolution sees AI agents independently discover these repositories and relay the attacker's installation instructions to their users.
FakeGit is a large-scale operation of roughly 7,600 malicious GitHub repositories, created by about 6,600 profiles, that disguise SmartLoader malware as ordinary software downloads. More than 800 of these FakeGit repositories pose as AI Skills or MCP servers and have surfaced over 600 times across public AI registries, giving them a false sense of legitimacy.
Victims who download and run the ZIP "installer" trigger a LuaJIT loader chain that deploys SmartLoader, which then establishes persistence and delivers the StealC information stealer. The campaign's most notable evolution, dubbed AgentBaiting, sees AI agents independently discover these FakeGit repositories during routine tasks and relay the attacker's installation instructions to their users.
#1 A Continuation of Water Kurita's Lumma Stealer Operation
FakeGit works by making malware look like a routine software install, and it is not new. It is assessed as a continuation of an older operation that pushed Lumma Stealer, tracked by Trend Micro under the threat actor name Water Kurita. Operators copy or fabricate GitHub projects and host them under lookalike developer identities, often just one character off a real handle, then dress them up with fake star and fork counts, copied descriptions, and polished READMEs. Many impersonate familiar tools like Gmail, WhatsApp, Databricks, Jenkins, and Docker, and more than 800 pose as AI Skills or MCP servers, amplified by over 600 listings across public registries such as LobeHub, Glama, MCP.so, and MCP Market. The key evolution is AgentBaiting: an AI agent hunting for a capability can find one of these FakeGit repositories on its own, treat the attacker's README as legitimate documentation, and pass the install steps to its user. In Island's testing, Claude Code, Gemini, and ChatGPT all surfaced malicious repositories without being shown a link.
#2 A LuaJIT Loader Chain Disguised as a Software Install
The FakeGit attack starts the moment the victim opens the downloaded ZIP. A representative package holds no real software, just three files: a small launcher script (for example, application.cmd), a renamed LuaJIT-style runtime (luau.exe), and an obfuscated Lua payload disguised as a text or icon file (ico64.txt). The launcher passes the payload to the runtime, executing a roughly 300 KB single-line Lua program. Names vary across the campaign, but the structure is constant: a .cmd or .bat launcher, a LuaJIT-style runtime, and a payload masquerading as a text, icon, license, or data file. This loader chain drops SmartLoader, which hides its console window and persists through scheduled tasks under %LOCALAPPDATA%.
#3 A Blockchain Dead Drop Feeds SmartLoader's C2
Instead of moving laterally, the FakeGit campaign focuses on the endpoint and quietly stages its next payload. SmartLoader pulls its current command-and-control address from a value stored in a Polygon smart contract. This blockchain dead drop makes takedown harder and then retrieves encrypted stages from GitHub. Those stages lead to a PE crypter that injects the StealC information stealer into another process. Because the host is already compromised at execution, the fake "integration" never needs the access it advertised.
#4 StealC Harvests Live Sessions, Not Just Passwords
StealC handles the theft once it is running in memory. It targets browser passwords, cookies, active sessions, extension data, email and remote-access credentials, screenshots, and host details, then exfiltrates them over its C2 channel. Crucially for responders, StealC steals live sessions, not just stored passwords, so resetting credentials is not enough. Active browser sessions, OAuth grants, API tokens, and cloud and developer credentials must all be revoked to fully close out a FakeGit-related intrusion.
