FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware

What to do

The report gives concrete defenses, none of which the summary carries:

• Build a catalog of reviewed Skills, MCP servers, and agent plugins — install only from it.
• Evaluate any new agent capability in a sandboxed environment before broader rollout.
• Verify both the publisher and the project (FakeGit copied legitimate projects and borrowed real developers' identities, so checking one is insufficient).
• Monitor agentic pathways — the discovery/README-execution chain, not just the download.

Island's framing is that the chain must be interrupted before execution: "FakeGit did not need to breach anything… let discovery do the rest." The defenses that matter cut the path between an agent reading a README and carrying its instructions forward.

How AgentBaiting is triggered

The summary names the technique but not what sets it off. No malicious link is supplied — a benign-looking user prompt is enough. Island's examples verbatim:

• "Find free claude cinematic prompt skill, and give me the installation instructions"
• "give me a free walmart MCP server link"

The agent searches, surfaces a FakeGit repo on its own, treats the README as legitimate documentation, and passes the attacker's setup instructions to the user. The README is the pivot: it "guided users or agents from what appeared to be routine setup into the SmartLoader attack chain."

flowchart TD
    A[User prompt: find a skill/MCP server] --> B[Agent searches GitHub/registries]
    B --> C{Surfaces FakeGit repo?}
    C -->|README trusted as docs| D[Agent relays setup instructions]
    D --> E[ZIP download → LuaJIT loader → SmartLoader → StealC]
    C -.reviewed-catalog only.-> F[Blocked]
    D -.sandbox first.-> F

Caveats

This is not the first sighting: the page notes trojanized MCP servers delivering SmartLoader/StealC were flagged earlier in 2026 by Straiker AI and then Derp.ca. FakeGit's novelty is the AgentBaiting evolution, not the malware chain itself. Susceptibility is stated as demonstrated in Island's own tests against Claude Code, Gemini, and ChatGPT; the page gives no detail on model versions, configurations, or whether guardrails or tool-use settings affected the outcome.