A large-scale operation dubbed 'FakeGit' is pushing SmartLoader and StealC malware through 7,600 malicious GitHub repositories that accumulated more than 14 million downloads. [...]

A large-scale operation dubbed 'FakeGit' is pushing SmartLoader and StealC malware through 7,600 malicious GitHub repositories that accumulated more than 14 million downloads.

A large-scale campaign called FakeGit is using 7,600 malicious GitHub repositories to distribute SmartLoader and StealC, with more than 14 million recorded download events across public release assets. Researchers say the operation uses “agentbaiting” to lure AI agents and developers into trusting fake AI tools, while its roots appear tied to an earlier Lumma Stealer campaign linked to Water Kurita. #FakeGit #SmartLoader #StealC #LummaStealer #WaterKurita

Analyse de la campagne AgentBaiting (Island Security, août 2026) : plus de 800 faux Skills et serveurs MCP conçus pour être découverts et recommandés par des agents IA eux-mêmes, livrant SmartLoader p...

Malware operators are increasingly using tools built to extend artificial intelligence as a delivery route. A newly documented campaign called AgentBaiting uses fraudulent AI Skills and Model Context Protocol, or MCP, servers to distribute SmartLoader malware through trusted-looking GitHub projects and public capability catalogs. The operation turns a routine search for an AI integration into a malware risk. Victims can be steered to ZIP archives presented as useful installers, then encouraged to extract and run files that have no connection to the advertised tool. Island researchers identified the campaign while tracking the wider FakeGit operation. Island said in a report shared with Cyber Security News (CSN) that it found about 7,600 malicious repositories created by roughly 6,600 profiles, including more than 800 posing as AI Skills or MCP servers. The campaign’s reach makes it more than a typical developer scam. The AI-focused wave built through March and peaked in April 2026, while malicious projects appeared more than 600 times across public AI registries and catalogs. The scale of the FakeGit operation (Source – Island.io) Researchers also measured more than 14 million downloads from release assets in approximately 200 campaign repositories. AgentBaiting Campaign Uses 800 Fake AI Skills and MCP Servers FakeGit builds credibility through copied projects, lookalike accounts, convincing documentation, and modest engagement numbers. One lure copied the name and positioning of a popular Claude Skills collection, then offered a confirmed SmartLoader ZIP archive as the download. The approach echoes earlier  fake GitHub malware delivery  activity that exploited familiar development workflows to gain trust. The fake Mann1988 – awesome-claude-skills repository imitates the original ComposioHQ – awesome-claude-skills project (Source – Island.io) The lures target both personal and business tasks, including email, messaging, analytics, build systems, cloud services, and developer tools. Their names make downloads appear relevant to daily work instead of suspicious. Island found that 62 malicious repositories were positioned for enterprise or developer-internal use, while nearly two-thirds of MCP lures claimed to connect cloud services, databases, or APIs. A repository named  45d5r/databricks-mcp-server  shows how the infection begins. Its documentation advertises an enterprise integration and provides a download button, but the linked archive contains a command launcher, a renamed LuaJIT-style runtime, and an obfuscated Lua program disguised as a text file. Running the launcher activates the concealed payload rather than installing an MCP server. Related variants can hide their console windows, locate their command server through a value stored in a Polygon smart contract, create scheduled-task persistence, and retrieve encrypted stages from GitHub. The FakeGit attack chain (Source – Island.io) The stages eventually inject StealC into another process, continuing the credential-theft threat covered in reporting on the  StealC infrastructure disruption . AI Discovery Becomes Risk AgentBaiting changes the threat because an AI agent can discover the malicious project without a victim receiving a direct link. During testing, researchers found that Claude Code, Gemini, and ChatGPT could independently surface campaign repositories when asked to find a Skill or MCP server. The results varied, but still exposed a dangerous gap. One tested agent recommended a benign option while also repeating malicious installation instructions as an alternative. In another test, Gemini returned a malicious Walmart MCP repository as its first result, while ChatGPT listed the same repository among public options and highlighted it as a starting point. Public registries can further expand that exposure. Island found more than 600 campaign listings across LobeHub, Glama, MCP.so, and MCP Market, with some reproducing attacker-written documentation and download instructions. That gives malicious repositories another layer of credibility, particularly as  MCP server security concerns  grow around AI integrations that can access business resources. Organizations should rely on a curated and reviewed catalog for Skills, MCP servers, and agent plug-ins instead of unrestricted discovery. Campaign-linked Skills and MCP servers (Source – Island.io) New capabilities should be tested in an isolated environment without browser sessions, cloud credentials, SSH keys, or production data. A supposed AI capability distributed as a Windows ZIP containing a launcher and hidden payload should be rejected. Teams should verify publishers as carefully as projects, since star counts, copied profiles, and registry listings do not establish legitimacy. They should monitor downloads, Git clones, shell commands, and changes to MCP or Skill configurations initiated by agents. Maintaining an inventory of each capability’s repository, commit, version, and package hash can speed investigation. If SmartLoader execution is suspected, security teams should isolate the endpoint and revoke active browser sessions, OAuth grants, API tokens, cloud credentials, and developer credentials. Password resets alone may not be enough because StealC can steal live sessions, browser data, email and remote-access credentials, screenshots, and host details. Indicators of Compromise (IoCs):- Type Indicator Description GitHub repository hfgwyge/yu-ai-agent Fake AI agent repository File name yu-ai-agent-1.0-beta.3.zip SmartLoader package SHA-256 216a2c99fd42c00f9323d8b16dd19f622f7f4778b2b1d7cf07a3de5621f2 Package hash GitHub repository Mann1988/awesome-claude-skills Fake Claude Skills repository File name awesome-skills-claude-3.3.zip SmartLoader package SHA-256 91e5dbfaf45edf25fbc2168f92083e05dfa427afa7633e991392e33cc743 Package hash GitHub repository h4vzz/awesome-ai-agent-skills Fake AI agent Skills repository File name agentaiawesomeskills2.0.zip SmartLoader package SHA-256 498fe8fb806cd0e6685f97fc7d74de769dae5a28cdc821557b7585ad5ad Package hash GitHub repository StanLeyJ03/mcp-for-security Fake security MCP repository File name for-security-mcp-3.3.zip SmartLoader package SHA-256 62744baa8077bb8be237647fd78e3bea2ca0932bf4be3d5618600f971185 Package hash GitHub repository xbim08/awesome-claude-code-plugins Fake Claude Code plug-ins repository File name pluginsclaudeawesomecode2.4.zip SmartLoader package SHA-256 1da8df487d30b988f3c350c065206726aaa13f079a07151cd42ab557999 Package hash GitHub repository DomingosNgongo/walmart-mcp Fake Walmart MCP repository File name mcp-walmart-2.2.zip SmartLoader package SHA-256 c15693106682f2ddb26649cab6e1962a64537627cde4c5d3c79d5a0be8c7 Package hash GitHub repository 45d5r/databricks-mcp-server Fake Databricks MCP repository File name serverdatabricksmcp1.6.zip SmartLoader package SHA-256 66afc7d87d10dbe392898c4e5c613e0442fabb396415c2bef3a5ef2ac758 Package hash GitHub repository MauManto/jenkins-mcp-server Fake Jenkins MCP repository File name mcp-server-jenkins-3.2.zip SmartLoader package SHA-256 a33f40cab1ab7f971d3464af3e7595918107332b9e83342007571842b9e Package hash GitHub repository waynestimulative605/docker-mcp-gateway Fake Docker MCP gateway repository File name gateway-docker-mcp-v1.6-alpha.5.zip SmartLoader package SHA-256 3c858facbad66f5479e2c4add171421dc1b6488b36f33e7cff073aba585 Package hash GitHub repository lucaducapuca/alibabacloud-bigdata-skills Fake Alibaba Cloud Skills repository File name alibabacloud-skills-bigdata-v1.7.zip SmartLoader package SHA-256 fc1278f419e611bf40ca414099bfd9ad98a31ffb054371e8cb65a84849b Package hash Note:   IP addresses and domains are intentionally defanged (e.g.,  [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM . Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. ->  Integrate ANY.RUN With Your SOC  Now . The post AgentBaiting Campaign Uses 800 Fake AI Skills and MCP Servers to Deliver SmartLoader Malware appeared first on Cyber Security News .

SmartLoader campaign spreading StealC via a trojanized Oura MCP server using fake GitHub forks to steal credentials and crypto funds.

A large-scale operation dubbed 'FakeGit' is pushing SmartLoader and StealC malware through 7,600 malicious GitHub repositories that accumulated more than 14 million downloads. [...]

Curate Feeds | Make Collections | Customize Email Briefs

Learn how SmartLoader is being spread through deceptive GitHub repositories, targeting users with gaming and software tools.

A large-scale operation dubbed 'FakeGit' is pushing SmartLoader and StealC malware through 7,600 malicious GitHub repositories that accumulated more than 14 million downloads.

Hackers used a fake Oura MCP server to trick users into downloading malware that installs the StealC info-stealer.

Cybersecurity researchers have uncovered a sophisticated malware distribution campaign utilizing GitHub repositories disguised as legitimate software projects. The SmartLoader malware has been strategically deployed across multiple repositories, capitalizing on users’ trust in the popular code-sharing platform to infiltrate systems worldwide. The malicious campaign targets users searching for game cheats, software cracks, and automation tools by positioning fraudulent repositories at the top of search results. SmartLoader distribution site being displayed at the top of Google search results (Source – ASEC) These repositories appear authentic, complete with professionally crafted README files, project documentation, and realistic file structures that mirror legitimate open-source projects. The threat actors behind this operation have demonstrated remarkable attention to detail, making their malicious repositories virtually indistinguishable from genuine software projects. Each compromised repository contains carefully constructed compressed files hosting the SmartLoader payload. When users download and execute these files, they unknowingly initiate a multi-stage infection process that establishes persistent access to their systems. ASEC analysts identified this widespread distribution method as particularly concerning due to its exploitation of developer and gaming communities’ trust in GitHub as a reliable source for software tools. Technical Infection Mechanism and Payload Deployment The SmartLoader infection process begins when users execute the Launcher.cmd file, which serves as the initial attack vector. This malicious batch file loads an obfuscated Lua script through luajit.exe , a legitimate Lua interpreter that has been weaponized for malicious purposes. Files inside the compressed file (Source – ASEC) The malware package consists of four core components: java.exe (the legitimate Lua loader), Launcher.cmd (malicious batch file), lua51.dll (Luajit runtime interpreter), and module.class (obfuscated Lua script). Once activated, SmartLoader establishes persistence by copying essential files to the %AppData%\ODE3 directory and registering itself in the Windows Task Scheduler as “SecurityHealthService_ODE3”. The malware immediately captures screenshots and system information, transmitting this data to command-and-control servers through Base64-encoded communications. The malware’s most dangerous capability lies in its role as a loader for additional payloads. Analysis revealed that SmartLoader downloads and executes secondary malware including Rhadamanthys infostealer, which targets sensitive information from email clients, FTP applications, and online banking services. The malware performs process injection into legitimate Windows processes such as openwith.exe , dialer.exe , and dllhost.exe to evade detection. Communication with C2 servers occurs through encrypted channels, with the malware receiving JSON-formatted commands containing configuration parameters and task lists. This infrastructure allows threat actors to dynamically update malware behavior and deploy additional payloads based on the infected system’s characteristics. This campaign highlights the critical importance of verifying software sources and examining repository credibility, commit history, and author authenticity before downloading any GitHub-hosted applications, particularly those related to game modifications or software cracks . Boost your SOC and help your team protect your business with free top-notch threat intelligence:  Request TI Lookup Premium Trial . The post SmartLoader Malware via Github Repository as Legitimate Projects Infection Users Computer appeared first on Cyber Security News .

Cybersecurity researchers have identified a SmartLoader campaign exploiting a trojanized version of the MCP (Model Context Protocol) server from Oura Health, which is used to connect AI assistants to health data from the Oura ring. The attackers have cloned this legitimate server to deploy the information-stealing malware StealC. No specific date or geographic target is mentioned. The impact includes the theft of sensitive data via this malware. Source: https://thehackernews.com/2026/02/smartloader-attack-uses-trojanized-oura.html

The Rise of AI-Driven Cyber Threats Cybercriminals are evolving their tactics, now leveraging AI-generated fake GitHub repositories to distribute malware. A recent campaign uncovered by security researchers reveals how threat actors are disguising malicious software as game cheats, cracked software, and system tools, tricking unsuspecting users into downloading harmful payloads. This campaign specifically delivers SmartLoader, which then installs Lumma Stealer, a notorious information-stealing malware used for credential theft, cryptocurrency wallet hijacking, and other malicious activities.

Distribution of SmartLoader Malware via Github Repository Disguised as a Legitimate Project ASEC

Reduce cyber supply chain risk with full reports for third-party risk management, continuous vendor monitoring, security ratings, and threat intelligence.

A fully unauthenticated MCP server in a Spring Boot communications platform exposed internal tools that enabled tool enumeration, SSRF to AWS IMDS, and LFI via file://, leading to live AWS IAM credential and database secret exposure. The case highlights how rapidly adopted MCP infrastructure has become a high-risk AI attack surface, with recent activity linked to GTG-1002, postmark-mcp, SmartLoader, and other MCP-targeting campaigns. #MCP #AWSIMDS #GTG-1002 #postmark-mcp #SmartLoader

Contract: Unverified | Balance: $0 across 0 Chains | Transactions: 7 | As at Jan-26-2026 03:42:00 PM (UTC)

Emergence of AgentBaiting Threat Vector The surging popularity of artificial intelligence tools has transformed skill directories into lucrative initial access points. Attackers target Model Context Protocol (MCP) server repositories to distribute malicious loads. Notably, the FakeGit operation weaponized roughly 7,600 GitHub repositories. This widespread campaign actively disseminated SmartLoader and the StealC infostealer. According to research from Island, over 800 repositories masqueraded as specialized AI skills and MCP servers.

Analyse de la campagne AgentBaiting (Island Security, août 2026) : plus de 800 faux Skills et serveurs MCP conçus pour être découverts et recommandés par des agents IA eux-mêmes, livrant SmartLoader p...