What This Is
An ongoing campaign tracked as FakeGit is running roughly 7,600 counterfeit GitHub repositories across about 6,600 accounts. They impersonate real open-source projects, carry convincing READMEs, and direct the visitor to a ZIP file that installs SmartLoader — a LuaJIT-based loader whose job is to fetch and run StealC, an infostealer.
As of July 2026 the operation had recorded more than 14 million downloads across GitHub Release assets in roughly 200 of those repositories. Thousands more embed the ZIP directly in the repo tree, where GitHub does not publish a download count at all — so 14 million is a floor, not a total.
This is not new activity. Trend Micro documented the first wave in March 2025 delivering Lumma Stealer, attributed to Water Kurita. Hexastrike catalogued 109 repositories across 103 accounts in April 2026. Netskope tied a parallel branch to the TroyDens lure factory, hitting financial services, banking and technology firms across North America, Asia and Southern Europe. What is new is the delivery route.
The lure is no longer aimed only at humans. Over 800 of these repositories pose as AI Skills or MCP servers, and Claude Code, Gemini and ChatGPT have all surfaced them in testing — without ever being shown a link.
Why This One Is Different — AgentBaiting
Every previous version of this attack needed a person to search, judge, and click. The current wave does not. An AI coding agent, asked to find a capability, can discover a campaign repository on its own, read the attacker's README as if it were documentation, and hand the installation steps to its operator as a recommendation. Island Security, who published the research, call this AgentBaiting.
In their testing, Gemini and ChatGPT both returned DomingosNgongo/walmart-mcp as the first recommendation for a free Walmart MCP server. That repository's download is a confirmed SmartLoader package. Claude Code, asked for a cinematic prompt Skill, found both a legitimate repository and a malicious one, recommended the legitimate one — but still repeated the malicious README's instructions as a usable alternative, including the line "click More info → Run anyway if a security prompt appears."
In other runs Claude inspected the repository, recognised the contents, and refused. That inconsistency is the finding. A control that works most of the time, against a campaign running at this scale, is a control that fails regularly.
The reach extends past GitHub. More than 600 campaign listings appear across public MCP and Skill registries — LobeHub, Glama, MCP.so and MCP Market. Several of those registries reproduce the attacker's README verbatim, carrying the malicious download link onto a second platform that looks like curation.
The Chain
The package is small and the structure is consistent. A real MCP server or Skill is source code with a manifest. This is a Windows ZIP containing three files:
server_databricks_mcp_1.6.zip
|
+-- application.cmd <- launcher, one line
+-- luau.exe <- renamed LuaJIT-style runtime
+-- ico64.txt <- ~300 KB obfuscated Lua payload, NOT an icon
application.cmd:
start luau.exe ico64.txt
Filenames rotate across the campaign, but the shape does not: a small .cmd or .bat launcher, a renamed script runtime, and an executable payload disguised as a .txt, .ico, .license or .dat file. That triple is the signature worth hunting for — it is not a shape that legitimate software ships in.
From there SmartLoader hides its console window, then resolves its current command-and-control address from a value stored in a Polygon smart contract. That is the detail that makes takedowns ineffective: there is no domain to seize and no IP to sinkhole, because the address is read from a public blockchain at runtime and the operator can rewrite it whenever they like.
It then pulls encrypted stages from further attacker-controlled GitHub repositories, decrypts them into a redundant Lua stage and a packed PE, and reflectively loads StealC into another process. Host metadata and collected artefacts, including screenshots, go out as multipart/form-data POSTs to /api/<victim_id>.
Persistence
Two scheduled tasks, both masquerading as ordinary software — audio managers, Office components — pointing at binaries and Lua stages under %LOCALAPPDATA%. The pairing is deliberate:
Task A -> executes a CACHED local copy of the Lua stage
survives takedown of the source GitHub repo
Task B -> re-downloads a FRESH encrypted stage from GitHub each run
recovers from local file cleanup
Removing the files alone leaves Task B to re-infect. Blocking the repo alone leaves Task A running. Both tasks have to go, and the endpoint should be treated as fully compromised regardless.
Hunting — Windows
Start with the file-shape signature rather than hashes. Hashes rotate; the structure has not.
# A script runtime living somewhere it has no business being
Get-ChildItem "$env:LOCALAPPDATA","$env:APPDATA","$env:TEMP" -Recurse -Include `
luau.exe,lua*.exe,luajit*.exe -ErrorAction SilentlyContinue |
Select-Object FullName,Length,CreationTime
# Scheduled tasks pointing into per-user writable paths
Get-ScheduledTask | ForEach-Object {
$a = $_.Actions | Where-Object { $_.Execute -match 'LOCALAPPDATA|AppData|Temp' }
if ($a) { [pscustomobject]@{
Task=$_.TaskName; Path=$_.TaskPath; Runs=$a.Execute; Args=$a.Arguments } }
}
# A large "text" file that is really code
Get-ChildItem "$env:LOCALAPPDATA" -Recurse -Include *.txt,*.dat,*.ico `
-ErrorAction SilentlyContinue | Where-Object Length -gt 100KB |
Select-Object FullName,Length
And the parent-child relationship, which is the cleanest single detection:
// Microsoft Defender / Sentinel — a .cmd spawning a script runtime
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("cmd.exe","conhost.exe")
| where FileName matches regex @"(?i)^(luau|lua|luajit).*\.exe$"
| where ProcessCommandLine has_any (".txt",".dat",".ico",".license")
| project Timestamp, DeviceName, AccountName, FileName,
ProcessCommandLine, InitiatingProcessCommandLine, FolderPath
Indicators — Selected
Representative repositories and the SHA-256 of their SmartLoader ZIPs, from the Island research. The full list is published in their artifacts repository.
REPOSITORY ZIP / SHA-256
hfgwygey/yu-ai-agent yu-ai-agent-1.0-beta.3.zip
216a2c99fd42c00f9323d8b16dd19f622f7f4778b2b1d7cf07a3de5621fd1546
Mann1988/awesome-claude-skills awesome-skills-claude-3.3.zip
91e5dbfaf45edf25fbc2168f92083e05dfa427afa7633e991392e33cc7427dad
h4vzz/awesome-ai-agent-skills agent_ai_awesome_skills_2.0.zip
498fe8fb806cd0e6685f97fc7d74de769dae5a28cdc821557b7585ad5ad83147
StanLeyJ03/mcp-for-security for-security-mcp-3.3.zip
62744baa8077bb8be237647fd78e3bea2ca0932bf4be3d5618600f97118095f8
xbim08/awesome-claude-code-plugins plugins_claude_awesome_code_2.4.zip
1da8df487d30b988f3c350c065206726aaa13f079a07151cd42ab5579994b9de
DomingosNgongo/walmart-mcp mcp-walmart-2.2.zip
c15693106682f2ddb26649cab6e1962a64537627cde4c5d3c79d5a0be8c1b5a8
45d5r/databricks-mcp-server server_databricks_mcp_1.6.zip
66afc7d87d10dbe392898c4e5c613e0442fabb396415c2bef3a5ef2ac752c5ad
MauManto/jenkins-mcp-server mcp-server-jenkins-3.2.zip
a33f40cab1ab7f971d3464af3e7595918107332b9e83342007571842b9e22826
waynestimulative605/docker-mcp-gateway gateway-docker-mcp-v1.6-alpha.5.zip
3c858facbad66f5479e2c4add171421dc1b6488b36f33e7cff073aba585954a7
lucaducapuca/alibabacloud-bigdata-skills alibabacloud-skills-bigdata-v1.7.zip
fc1278f419e611bf40ca414099bfd9ad98a31ffb054371e8cb65a84849b00eaf
BEHAVIOURAL
.cmd / .bat launcher + renamed Lua runtime + oversized .txt/.ico payload
Two scheduled tasks under %LOCALAPPDATA% posing as audio/Office components
multipart/form-data POST to /api/<victim_id>
Outbound lookups to Polygon RPC endpoints from a non-developer workstation
Spotting The Repository Before You Run It
The accounts are built to survive a glance, not an inspection. Mann1988/awesome-claude-skills copied a real project with 67,000 stars and accumulated 63 stars and 18 forks of its own — enough to look real in a search result. The account Naveenkm007 differs from the genuine developer Naveenkm07 by a single character and mirrors their profile.
The reliable tell is not the account. It is the artifact. A Skill or an MCP server is source code with a manifest. If installing a "capability" means downloading a Windows ZIP and running an executable, the thing being installed is not a capability. Star counts, fork counts, commit history and registry listings are all cheap to fake. The file structure is not.
If You Ran One
Isolate the endpoint first. Not shut it down — isolate it. StealC has already run by the time anything looks wrong, and you want the memory and the scheduled tasks intact for the investigation.
Revoke sessions, not just passwords. This is the part most people get wrong. StealC takes live browser cookies and session tokens, so resetting a password does not evict the attacker — they are already authenticated. You must invalidate active browser sessions, OAuth grants, API tokens, cloud credentials, developer tokens and SSH keys.
Assume the credential store is gone. Browser-saved passwords, extension data, email and remote-access credentials, and anything the browser had a live session with. For a developer workstation that plausibly includes source control, cloud consoles, CI/CD and package registries.
Kill both scheduled tasks, then rebuild. Removing one leaves the other to restore it. Given the endpoint has run arbitrary attacker-selected payloads, rebuild is the honest answer — cleaning is a guess.
Then check what the credentials could reach. Private repositories, deployment pipelines, production. The workstation is the entry point, not the objective.
What I'd Do Before This Reaches You
Curate the catalog. This campaign depends entirely on open discovery. A reviewed internal list of approved Skills, MCP servers and agent plugins removes the audience — human and agent both — while still giving your developers a fast path to what they need.
Evaluate new capabilities somewhere disposable. No browser sessions, no cloud credentials, no SSH keys, no production data. These packages fail that test in seconds, because the ZIP contents give them away immediately.
Watch what your agents do, not only your users. A git clone, a download or a shell command can now originate from an agent finishing a routine task. Agent-initiated retrievals and any change to Skill directories or MCP configuration deserve the same scrutiny as a browser download — and most organisations are not logging them at all today.
Inventory the AI capabilities already in use — repository, commit, version, package hash. When the next batch of repositories is published, that inventory is the difference between answering "are we affected" in minutes or in weeks.
Application allowlisting stops this outright. A renamed Lua runtime executing from %LOCALAPPDATA% is exactly what allowlisting exists to prevent, and it does not care that the delivery route was novel.
Assessment
The malware chain here is unremarkable. Loader, blockchain-resolved C2, stealer — all of it has been seen before, and the sample structure has barely changed since the 2025 wave. What changed is who does the recommending.
For twenty years the advice has been "don't download software from untrusted sources," and it worked because a human made the trust decision. An AI agent asked to find a tool makes that decision now, at machine speed, from a README the attacker wrote, and hands the result to someone who reasonably assumes it was vetted. The attacker did not need to compromise the agent. They only needed to publish documentation the agent would believe.
Expect this route to be reused. It is cheap, it scales, and the registries indexing these repositories have no verification step worth the name.
Sources
Island Security Research — AgentBaiting: How 800+ Fake AI Skills and MCP Servers Delivered Malware, July 2026 (Oleg Zaytsev)
Hexastrike Cybersecurity — Cloned, Loaded, and Stolen: 109 Fake GitHub Repositories, April 2026
Trend Micro — AI-Assisted Fake GitHub Repositories Fuel SmartLoader and Lumma Stealer Distribution, March 2025
Hexastrike Cybersecurity — Cloned, Loaded, and Stolen: 109 Fake GitHub Repositories, April 2026
Trend Micro — AI-Assisted Fake GitHub Repositories Fuel SmartLoader and Lumma Stealer Distribution, March 2025
More like this, when it happens
Advisories only. No newsletter, no marketing, unsubscribe in one click.
Barr Cyber — Developer Endpoint & Supply Chain Hardening
Developer workstations hold cloud credentials, signing keys and live sessions — which is exactly why this campaign targets them. If your team installs open-source tooling or AI capabilities as part of normal work, and nothing is watching what gets executed from AppData, that gap is worth closing before it is found for you.
Get in Touch →