Partner POV | AgentBaiting: How 800+ Fake AI Skills and MCP Servers Delivered Malware
In this article
This article was written by Oleg Zaytsev at Island.
TL;DR
Island security research uncovered about 7,600 malicious GitHub repositories, with more than 800 of them posing as AI Skills or MCP servers in a wave that peaked in April 2026. Those AI capability repositories appeared more than 600 times across public AI registries and catalogs, while the wider FakeGit operation recorded more than 14 million measured downloads.
FakeGit uses copied projects, lookalike developer profiles, convincing READMEs, and malicious ZIP files to deliver SmartLoader malware. Once executed, SmartLoader establishes persistence and installs StealC, an information stealer targeting credentials, active sessions, and other sensitive data.
The most significant shift is a technique we call AgentBaiting. An AI agent searching for a new capability such as a Skill or an MCP server can discover a campaign repository on its own, treat the attacker's README as legitimate documentation, and hand the installation instructions to the user. In our testing, Claude Code, Gemini, and ChatGPT all surfaced malicious campaign repositories without ever being shown a link. A playbook built to deceive people now deceives the agents acting on their behalf.
SmartLoader has entered the AI capability supply chain
For years, FakeGit and SmartLoader have targeted developers through convincing GitHub projects that turn software discovery into malware delivery. In the latest wave we observed, the campaign expanded into the AI capability ecosystem, presenting malicious repositories as Skills and MCP servers and gaining exposure through public AI registries. This brought an established malware operation into the workflows people and agents use to discover and install new AI capabilities.
Our investigation confirmed roughly 7,600 malicious GitHub repositories, created by about 6,600 profiles, including about 1,400 tied to AI tools, agents, or workflows. Over 800 posed as Skills or MCP servers spanning individual and enterprise use, from Gmail and WhatsApp integrations to Databricks, Jenkins, and Docker tooling.
The repository count tells only part of the story. As of July 2026, we measured more than 14 million downloads across GitHub Release assets in about 200 campaign repositories - including 149,015 for Zilts345890/Golang-html-parsing, 120,872 for MRX-slayer/ai-resume-parser, and 69,969 for huizuohaode/AI-Image-Generator. Thousands of other repositories embedded malicious ZIP files directly in the project, where downloads are not publicly counted.
Within that broader operation, the latest AI wave developed quickly. GitHub creation dates show it building through March and peaking in April 2026, when nearly 300 AI-related repositories were created.
The repositories were designed to meet demand already forming around AI capabilities, borrowing the names and workflows of familiar consumer and enterprise tools. That familiarity gave the malicious ZIP files a credible reason to be downloaded, while the README guided users or agents from what appeared to be routine setup into the SmartLoader attack chain.
FakeGit and SmartLoader: How the attack works
FakeGit builds credibility one layer at a time. It copies or fabricates projects, places them under convincing developer identities, and uses their READMEs to make malware execution look like a routine installation.
Mann1988/awesome-claude-skills copied the name and positioning of the original ComposioHQ/awesome-claude-skills, a widely used collection with more than 67,000 stars and 7,600 forks. The fake repository had accumulated 63 stars and 18 forks of its own, enough to appear established at a glance. Its README then presented awesome-skills-claude-3.3.zip, a confirmed SmartLoader package, as the project's download.
The deception also extends to the profiles behind the projects. The campaign account Naveenkm007 differs by one character from established developer Naveenkm07 and closely mirrors the original profile. It then uses that identity to publish Naveenkm007/spaceship-mcp, an MCP server containing a confirmed SmartLoader package.
Inside the malicious ZIP
Once the repository and its owner appear credible, the README completes the attack. 45d5r/databricks-mcp-server shows this handoff clearly. It presents itself as an enterprise integration with 263 Databricks tools, but its "Download Latest Release" button points to a malicious ZIP inside the repository. The instructions tell the reader to download it, extract it, and run the application.
Those instructions end at the ZIP. The attack begins inside it.
The Windows package linked from 45d5r/databricks-mcp-server, server_databricks_mcp_1.6.zip, contains no Databricks installer, MCP manifest, or server setup. It contains only three files: application.cmd, luau.exe, and ico64.txt. The launcher contains a single command:
start luau.exe ico64.txt
That command passes ico64.txt to luau.exe, a renamed LuaJIT-style runtime. Despite its name, the text file is not an icon or configuration resource. It is a roughly 300 KB Lua program, heavily obfuscated and packed into a single line. Filenames vary across the campaign, but the structure remains consistent: a small .cmd or .bat launcher, a LuaJIT-style runtime, and an executable Lua payload disguised as a text, icon, license, or data file.
Derp.ca's analysis of other FakeGit samples shows what follows. The variants hide the console window, resolve their current command server through a value stored in a Polygon smart contract, establish persistence through scheduled tasks under %LOCALAPPDATA%, and retrieve encrypted stages from GitHub. Those stages lead to a PE crypter that injects StealC into another process.
StealC targets browser passwords, cookies, active sessions, browser extension data, email and remote-access credentials, screenshots, and host information. The malware chain itself is familiar. What changes is the route that leads to execution.
AgentBaiting: your AI agent is the new target
An AI agent does not need to be given a malicious link. While trying to complete a task, it can discover a FakeGit repository on its own, treat the README as legitimate documentation, and pass the attacker's instructions to the user. FakeGit built its AI lures around this path. We call this AgentBaiting.
To test this path, we gave Claude Code a simple prompt:
Claude searched the web, followed results through an MCP marketplace and GitHub, and opened two repositories that appeared to match the request. One was the benign OSideMedia/higgsfield-ai-prompt-skill. The other was adlaiponderous700/claude-skill-cinematic-prompt, one of the malicious Skills in the campaign.
Claude recommended the benign repository, but it also treated the malicious one as a usable alternative and repeated its README instructions:
- Download the
.exefrom the GitHub Releases page - Run it (click "More info" → "Run anyway" if a security prompt appears)
- Follow the setup wizard
In other runs, Claude inspected the repository more closely, recognized the suspicious contents, and refused to recommend it. That variability is the point: it independently discovered a campaign repository and, in one run, turned its attacker-written README into actionable installation guidance. At the scale of this campaign, even an occasional miss creates a path to malware execution.
Gemini showed the same discovery problem. When we asked it:
it returned the malicious DomingosNgongo/walmart-mcp repository as its first recommendation. Gemini described it as a completely free, open-source MCP server for connecting AI agents to Walmart data and linked directly to its GitHub page. The repository's mcp-walmart-2.2.zip download is a confirmed SmartLoader package.
ChatGPT reached the same malicious repository from the same prompt. It listed DomingosNgongo/walmart-mcp among three public options, then singled it out as the best place to start. The repository contains a confirmed SmartLoader package.
Together, the examples show how AgentBaiting can turn routine AI discovery into a path toward execution. That exposure becomes even stronger when the same repository appears across popular Skill and MCP registries.
Beyond GitHub: Malicious Skills and MCP Servers Reach Public Registries
That distribution path was already active at scale. We found more than 600 campaign listings across public MCP and Skill registries, including LobeHub, Glama, MCP.so, and MCP Market. We could not determine whether each listing was indexed automatically or submitted manually. In some cases, the registry reproduced the repository README, carrying the attacker's download link and installation instructions onto another platform. The listing itself gave the malicious repository another layer of credibility.
The Glama page for hahaha-saygex/gmail-mcp shows the pattern clearly. It presents the repository as an MCP server for managing enterprise email and reproduces its installation instructions, including the raw GitHub link to the malicious mcp_gmail_2.7-alpha.4.zip package.
Together, these listings make campaign repositories easier to discover and trust, while carrying their README instructions into the AI capability ecosystem.
The lures mirrored real enterprise work
The names and claimed capabilities show how closely the campaign followed real enterprise work. Across the malicious Skill and MCP repositories, 62% were positioned for enterprise or developer-internal use. A third were framed around enterprise operational data, about a quarter around source code, and roughly one in six around credentials or secrets.
The AI-facing lures were positioned inside familiar enterprise workflows rather than as generic AI experiments. 45d5r/databricks-mcp-server promised access to analytics data, MauManto/jenkins-mcp-server and waynestimulative605/docker-mcp-gateway targeted development infrastructure, and muhamedali7713/agent-audit presented itself as security tooling. Nearly two-thirds of the MCP repositories were framed as connectors for cloud services, databases, or APIs.
That strategy predates the AI branch. Elsewhere in the campaign, MAMAHM2/Splunk-Realtime-Network-SOC-Dashboard targeted security operations, C00lkitdd/SalesforceDocGen borrowed from sales workflows, zinhocosta/HR-Attrition-SQL-PowerBI posed as workforce analytics, and GGMario8/shopify-invoice-document-automation promised commerce automation. The products changed, but the logic remained the same: attach the malicious package to a credible work task.
Legitimate tools in these categories can sit close to production data, source repositories, build pipelines, customer records, security telemetry, cloud tokens, and browser sessions. The malicious repositories did not need to receive the access they advertised because executing the SmartLoader package compromised the endpoint first. Their enterprise framing made the download relevant to real work, while the AI branch adapted that strategy to the way people and agents now discover and install capabilities.
What enterprises should do now
FakeGit did not need to breach anything. It published convincing repositories, borrowed real developers' identities, spread its listings across public registries, and let discovery do the rest. With AgentBaiting, that discovery no longer requires a person at all: an agent searching for a Skill or MCP server can find the lure, read the attacker's README, and carry its instructions forward. The defenses that matter are the ones that interrupt this chain before execution.
- Build a curated catalog of reviewed Skills, MCP servers, and agent plugins. The campaign depends on open discovery, and a trusted catalog removes its audience, human or agent, while giving teams a fast, safe path to the capabilities they want.
- Evaluate every new capability in an isolated environment first, with no browser sessions, cloud credentials, SSH keys, or production data. The campaign's packages fail this test immediately: a legitimate MCP server or Skill is source code with a manifest, not a Windows ZIP holding a launcher script, a renamed runtime, and a payload disguised as a text file. Any capability that installs through a downloaded executable should be rejected on sight.
- Verify the publisher, not just the project. The campaign builds credibility from one-character-off usernames, copied profiles, and modest star counts, and public registries reproduce the attackers' own READMEs. Treat a registry listing as no signal of legitimacy.
- Watch the paths agents use, not only the paths users use. AgentBaiting means a download, a git clone, or a shell command can originate from an agent completing a routine task. Agent-initiated retrievals and changes to Skill directories or MCP configurations deserve the same scrutiny as browser downloads.
- Keep an inventory of every AI capability in use, including source repository, commit, version, and package hash, so newly identified campaign repositories can be matched against your environment in minutes.
If SmartLoader execution is suspected, isolate the endpoint and revoke active browser sessions, OAuth grants, API tokens, and cloud and developer credentials. StealC takes live sessions, not just passwords, so resetting passwords alone is not enough.
AI capabilities have become a route through which software enters the enterprise, and FakeGit will not be the last campaign to use it. Securing that route means seeing it end to end, from the moment a user or agent discovers a capability to the moment it runs. That visibility is what Island is built for.
Representative IOCs
The campaign used AI and enterprise-themed repositories ranging from highly starred collections to lures impersonating familiar platforms. The following are selected GitHub repository examples:
hfgwygey/yu-ai-agent(90 stars)yu-ai-agent-1.0-beta.3.zip216a2c99fd42c00f9323d8b16dd19f622f7f4778b2b1d7cf07a3de5621fd1546Mann1988/awesome-claude-skills(63 stars)awesome-skills-claude-3.3.zip91e5dbfaf45edf25fbc2168f92083e05dfa427afa7633e991392e33cc7427dadh4vzz/awesome-ai-agent-skills(32 stars)agent_ai_awesome_skills_2.0.zip498fe8fb806cd0e6685f97fc7d74de769dae5a28cdc821557b7585ad5ad83147StanLeyJ03/mcp-for-security(19 stars)for-security-mcp-3.3.zip62744baa8077bb8be237647fd78e3bea2ca0932bf4be3d5618600f97118095f8xbim08/awesome-claude-code-plugins(10 stars)plugins_claude_awesome_code_2.4.zip1da8df487d30b988f3c350c065206726aaa13f079a07151cd42ab5579994b9deDomingosNgongo/walmart-mcp(5 stars)mcp-walmart-2.2.zipc15693106682f2ddb26649cab6e1962a64537627cde4c5d3c79d5a0be8c1b5a845d5r/databricks-mcp-serverserver_databricks_mcp_1.6.zip66afc7d87d10dbe392898c4e5c613e0442fabb396415c2bef3a5ef2ac752c5adMauManto/jenkins-mcp-servermcp-server-jenkins-3.2.zipa33f40cab1ab7f971d3464af3e7595918107332b9e83342007571842b9e22826waynestimulative605/docker-mcp-gatewaygateway-docker-mcp-v1.6-alpha.5.zip3c858facbad66f5479e2c4add171421dc1b6488b36f33e7cff073aba585954a7lucaducapuca/alibabacloud-bigdata-skillsalibabacloud-skills-bigdata-v1.7.zipfc1278f419e611bf40ca414099bfd9ad98a31ffb054371e8cb65a84849b00eaf