⚠️ FakeGit: AI Deception & Cyber Chaos 💥

FAKEGIT: A SCALED MALWARE CAMPAIGN
FakeGit, a malware campaign documented by Island in July 2026, represents a significant threat landscape. The campaign involved the deployment of approximately 7,600 fake GitHub repositories, alongside 6,600 fraudulent profiles and over 14 million downloads. This scale underscores the evolving tactics employed by malicious actors seeking to exploit trust within developer ecosystems. Over 800 repositories were designed to mimic AI skills and MCP servers, distributing the SmartLoader and StealC infostealers, highlighting the deceptive nature of the operation.

THE LEAK: EXPLOITING AGENT ARCHITECTURE
The surprise element of the FakeGit campaign was the independent recommendation of malicious repositories by Gemini and ChatGPT. The same fake walmart-mcp repository was suggested by both AI assistants, leading users to install software containing SmartLoader and StealC. Attackers cleverly bypassed direct user deception by leveraging the trust placed in these widely-used AI tools. This demonstrates a shift in attack methodology, prioritizing the exploitation of trusted intermediaries rather than direct manipulation of users.

TECHNICAL SPECS: SMARTLOADER AND STEALC
The malware distributed within the FakeGit repositories, primarily SmartLoader and StealC, represents a sophisticated threat. SmartLoader, once downloaded, deployed StealC to extract sensitive information. This included browser credentials, cookies, active sessions, and cryptocurrency wallet data, targeting a range of potential vulnerabilities. The deployment mechanism highlights the ease with which attackers can leverage seemingly legitimate software to execute malicious activities.

NEXT STEPS: CONTAINMENT AND MITIGATION
Following the discovery of the FakeGit campaign, Island initiated efforts to identify and remove the affected repositories. The incident prompted a broader investigation into the vulnerabilities present in AI assistant integrations within developer environments, aiming to understand the root causes and implement preventative measures. Immediate steps included reporting the fraudulent activity to GitHub and collaborating on remediation efforts.

AGENT’S VULNERABILITY: PROMPT INJECTION AND THE LETHAL TRIFECTA
Two key architectural characteristics of AI agents contribute to the success of attacks. Firstly, agents process instructions and external information as text, making them susceptible to indirect prompt injection – where malicious instructions within README files, webpages, or tool descriptions are interpreted as commands to be executed. Secondly, the combination of access to valuable information, exposure to untrusted external content, and the ability to send data outside the system – known as the lethal trifecta – allows malicious text to translate into a potential data breach. Simon Willison’s framework provides a concise explanation of this complex vulnerability.

OTHER ATTACKS: FABRICATED TRUST SIGNALS
Beyond prompt injection, attacks exploit fabricated trust signals within developer environments. Stars, downloads, contributor histories, and registry listings can create a false impression of legitimacy, making malicious software appear credible. This tactic is particularly effective in leveraging the inherent social validation mechanisms found within open-source platforms. The manipulation of these signals undermines the core principles of community-driven development.

EIGHT WAYS WEAKNESSES ARE EXPLOITED
1.

AgentBaiting:
Attackers created convincing repositories with realistic documentation and distributed them through public registries, leading Gemini and ChatGPT to independently recommend the same fake Walmart MCP connector. The repositories distributed SmartLoader, which downloaded StealC to steal browser credentials, cookies, active sessions, and cryptocurrency wallet data. 2.

Tool Poisoning:
Instructions embedded in tool descriptions can manipulate trusted email connectors into copying outgoing messages to attacker-controlled domains. Invariant Labs demonstrated this vulnerability in April 2025. 3.

When Agents Conceal Their Actions:
A 2026 academic study confirmed 157 skills as malicious, identifying 632 vulnerabilities and 13 attack techniques. One recurring instruction gave the research its title: “Do Not Mention This to the User.” 4.

Rug Pull:
A package may behave legitimately for months before introducing malicious functionality. Postmark-mcp, a connector impersonating the legitimate Postmark email service, initially appeared harmless. Version 1.0.16 introduced a hidden BCC recipient that copied outgoing emails to an attacker-controlled domain. 5.

MCPoison:
A vulnerability in Cursor allowed attackers to modify previously approved project configurations and execute commands without renewed approval. Check Point disclosed MCPoison in September 2025. 6.

When Agents Conceal Their Actions (Continued):
A 2026 academic study examined 98,380 skills from two registries and confirmed 157 as malicious, identifying 632 vulnerabilities and 13 attack techniques. 7.

ClickFix:
Attackers disguise malicious commands as installation prerequisites inside README or SKILL.md files. Users follow the instructions and execute the commands themselves. 8.

GTG-1002:
Anthropic reported a cyberespionage campaign in which attackers connected penetration-testing tools to Claude Code through MCP, allowing the model to independently perform approximately 80–90% of tactical operations.

THE ECONOMICS OF FAKE REPUTATION
Many attacks depend on artificially manufactured credibility. An April 2026 investigation found GitHub stars advertised...[truncated due to length]