Summary
A large-scale malware supply-chain campaign dubbed FakeGit has seeded approximately 7,600 malicious GitHub repositories impersonating popular tools — Gmail, WhatsApp, Databricks, Jenkins, Docker — to spread the SmartLoader dropper, which delivers the StealC information stealer. The campaign has recorded over 14 million downloads from GitHub Release assets across ~200 active campaign repositories.
A significant fraction of the fake repos (800+) specifically impersonate AI skills and MCP (Model Context Protocol) servers. This is deliberate. Researchers identified a novel technique called AgentBaiting: when AI agents — including Anthropic Claude Code, Google Gemini, and OpenAI ChatGPT — search for new MCP capabilities or AI skills, they can discover and recommend these bogus repositories to users, effectively acting as unwitting delivery vectors. SmartLoader establishes persistence via scheduled tasks and retrieves its C2 address through a Polygon smart contract, adding blockchain-based C2 resilience to the chain.
StealC harvests credentials, active sessions, and browser data. Organizations with AI coding assistants and MCP-enabled workflows are particularly exposed if they haven’t curated an approved catalog of MCP servers.
Source
The Hacker News
BleepingComputer
Help Net Security
Commentary
AgentBaiting is the most operationally interesting part of this campaign. Attackers are no longer just trying to trick humans — they’re engineering content that exploits AI agents’ tendency to search, retrieve, and recommend external resources. The attack chain is: attacker creates convincing repo → AI agent finds it while searching for MCP tools → agent recommends it to a human → human installs it. The human never independently searched for the malware; their AI assistant surfaced it.
This is a category of supply-chain attack that most organizations have no controls for yet. Maintain a curated, approved allowlist of MCP servers. Treat AI-agent-recommended external packages with the same scrutiny as any third-party dependency. Test new AI tooling in isolated sandboxes. And rotate secrets immediately if SmartLoader execution is suspected — the StealC payload targets active sessions, meaning credentials valid at time of infection are already gone.