AI Agents Steered to Malware on Fake GitHub Repos

How the attack worked

Researchers identified around 7,600 malicious GitHub repositories, including more than 800 posing as AI Skills or Model Context Protocol (MCP) servers, tied to roughly 6,600 accounts. The campaign, dubbed FakeGit, relied on copied projects, lookalike developer profiles, and convincing READMEs to make the repositories look like legitimate open-source tools. Victims who followed the install steps were led to download ZIP or EXE files that delivered SmartLoader, malware that establishes persistence and then installs StealC to steal credentials and active sessions.

What sets this campaign apart is a technique called AgentBaiting. Instead of relying solely on a human clicking a malicious link, attackers count on AI assistants to find the malicious repos during a routine search for a tool or capability. In testing, AI assistants surfaced these campaign repositories without ever being shown a link, and in one case an assistant recommended a legitimate option while also passing along the malicious repository's installation steps in the same response, including instructions to download an executable and click past a Windows security warning.

Why it succeeded

The attack exploits trust in two layers at once: trust in GitHub as a platform for open-source tools, and trust in AI assistants as a reliable filter for finding those tools. Public AI registries that listed or mirrored repository READMEs added a third layer, carrying malicious download links onto other platforms under those registries' own credibility. Because the AI agent, not the person, does the searching, the agent effectively becomes the target, standing in for the user it works for.

What to watch for

• Install instructions that tell you to download and run an executable, which is unusual for many legitimate Skills or MCP servers.
• Guidance that explicitly tells you to bypass a Windows security warning.
• A repository or publisher that looks slightly off, such as a lookalike handle or a copied README and layout.
• Brand-name integrations, such as a company-specific MCP server, offered for free from an unofficial or unverified publisher.

Building resistance

Organizations can reduce exposure by treating AI assistant recommendations as a starting point rather than a trusted source, and by verifying the publisher and project before installing anything. Building a curated, reviewed catalog of approved Skills and MCP servers, and testing new capabilities in a sandboxed environment first, limits exposure to unvetted repositories. If SmartLoader execution is suspected, isolate the affected endpoint and revoke active browser sessions, OAuth grants, API tokens, and cloud and developer credentials rather than just resetting passwords, since StealC targets live sessions directly.

What is AgentBaiting?

AgentBaiting is a technique where AI assistants discover malicious GitHub repositories on their own and relay the attacker's installation steps to the user, even without being given a direct link.

What malware does the FakeGit campaign deliver?

The campaign delivers SmartLoader, which establishes persistence and then installs StealC to steal credentials and active browser sessions.

How many malicious repositories were found?

Researchers identified roughly 7,600 malicious GitHub repositories, including more than 800 posing as AI Skills or MCP servers, tied to about 6,600 accounts.

Why is resetting passwords not enough after this attack?

StealC captures live sessions in addition to passwords, so defenders also need to revoke active browser sessions, OAuth grants, API tokens, and cloud and developer credentials.