FakeGit is a widespread campaign leveraging thousands of malicious GitHub repositories to distribute SmartLoader and StealC malware. The operation uses AgentBaiting, a technique that exploits AI agents' tendency to parse README files and recommend repositories, thereby increasing the likelihood of malware execution. The repositories impersonate popular consumer and enterprise tools and include fabricated metadata to appear credible. SmartLoader establishes persistence via scheduled tasks and retrieves command-and-control addresses through a Polygon smart contract, then downloads encrypted stages leading to StealC information stealer deployment. The campaign is linked to the threat actor 'Water Kurita' and has heavily targeted AI-related repositories since March 2026. Testing showed some AI agents can detect suspicious activity before execution, but detection rates are inconclusive. The campaign has significantly penetrated public AI registries and catalogs, complicating detection and mitigation.

The campaign has resulted in over 14 million cumulative downloads of malicious repositories, increasing the risk of widespread infection with SmartLoader and StealC malware. SmartLoader enables persistence on infected systems and facilitates the delivery of an information stealer, potentially compromising sensitive data. The use of AgentBaiting increases the likelihood that AI coding agents and developers will inadvertently execute malicious payloads. The campaign's infiltration of public AI skill registries and catalogs further amplifies its reach and credibility, posing a substantial threat to organizations relying on these resources.

No official patch or fix is applicable as this is a malware distribution campaign exploiting social engineering and repository impersonation. Organizations should maintain approved catalogs of AI skills and MCP servers, test new capabilities in isolated environments, and independently verify the authenticity of publishers and repositories before use. If SmartLoader execution is suspected, immediately rotate all secrets in affected environments. Vigilance in repository vetting and cautious use of AI agent recommendations are critical to mitigating risk.