AgentBaiting: How Fake AI Skills Deliver Malware at Scale

What it is

"AgentBaiting" is the latest wave of the long-running FakeGit / SmartLoader campaign, documented by Island security research. Roughly 7,600 malicious GitHub repositories (created by ~6,600 profiles, ~1,400 tied to AI tooling) impersonate legitimate projects; over 800 pose as AI Skills or MCP servers, from Gmail/WhatsApp to Databricks, Jenkins, and Docker integrations. The AI wave built through March and peaked in April 2026 (~300 AI repos created). The payload chain is SmartLoader → StealC (an info-stealer). The novel twist: AI agents discover and recommend these repos on their own.

How it works

The repos borrow real project names, lookalike author profiles, star/fork counts, and convincing READMEs. The README's "Download Latest Release" points to a malicious ZIP. Inside a sample (server_databricks_mcp_1.6.zip) are only three files: a launcher (application.cmd), a renamed LuaJIT runtime (luau.exe), and an obfuscated ~300 KB Lua payload disguised as a text/icon/data file (ico64.txt). The launcher runs:

start luau.exe ico64.txt

Downstream (per Derp.ca analysis of related samples): hides the console, resolves its C2 from a value in a Polygon smart contract, persists via scheduled tasks under %LOCALAPPDATA%, pulls encrypted stages from GitHub, then a PE crypter injects StealC, which grabs browser passwords, cookies, active sessions, extension data, email/remote-access creds, and screenshots.

The AgentBaiting shift: in Island's testing, Claude Code, Gemini, and ChatGPT all surfaced these malicious repos when asked to find a Skill/MCP server — without being given any link — and passed the README's install instructions to the user as legitimate documentation.

Preconditions / Affected

• A user or agent discovering AI capabilities via GitHub search or public AI registries (the repos appeared 600+ times across registries/catalogs).
• Windows for the confirmed payload structure (.cmd/.bat + LuaJIT runtime + disguised Lua file).
• Execution requires the user/agent to download, extract, and run the package — i.e., following the README.

What to do

The page gives no vendor patch; the mitigation is process/detection:

• Do not execute downloaded MCP/Skill packages on README instruction alone. Inspect the ZIP contents — a legitimate MCP server contains a manifest/server setup, not a lone .cmd + runtime + "text" file.
• Hunt for the payload signature: a small launcher invoking a renamed LuaJIT runtime against a disguised data file; scheduled-task persistence under %LOCALAPPDATA%; outbound traffic tied to Polygon RPC (C2 resolution).
• Treat these named repos/assets as IoCs: Mann1988/awesome-claude-skills (awesome-skills-claude-3.3.zip), Naveenkm007/spaceship-mcp, 45d5r/databricks-mcp-server, and high-download lures Zilts345890/Golang-html-parsing, MRX-slayer/ai-resume-parser, huizuohaode/AI-Image-Generator.
• Watch for typosquatted authors (e.g., Naveenkm007 vs. real Naveenkm07).

Caveats

Download counts (14M+ across ~200 repos) cover only public GitHub Release assets; ZIPs embedded directly in repos aren't counted, so exposure is understated. Downstream stage behavior is attributed to Derp.ca's analysis of other FakeGit samples, not all directly confirmed in Island's own sample.