Listen to this Post
Introduction: The Open-Source Ecosystem Faces a New AI-Era Threat
The rapid rise of artificial intelligence has fundamentally changed how developers build software. AI coding assistants, MCP servers, automation frameworks, and open-source repositories have become essential components of modern software development. Millions of developers now rely on AI-powered recommendations to accelerate coding, automate deployments, and integrate new tools within minutes.
Unfortunately, cybercriminals have adapted just as quickly.
A sophisticated malware campaign known as FakeGit demonstrates that attackers are no longer targeting only human developers—they are now deliberately manipulating AI assistants themselves. By flooding GitHub with thousands of fake repositories disguised as legitimate AI tools, threat actors have created an ecosystem where both developers and AI agents unknowingly become part of the infection chain.
Security researchers warn that this represents one of the largest examples yet of attackers exploiting trust in AI-generated recommendations. Instead of breaking into systems directly, criminals are poisoning the information sources AI models rely on, creating an entirely new attack surface for the software industry.
FakeGit Campaign Pushes SmartLoader and StealC at Massive Scale
Security researchers uncovered a large malware distribution campaign called FakeGit, involving approximately 7,600 malicious GitHub repositories designed to distribute the SmartLoader malware downloader and the StealC information stealer.
Among these repositories, over 1,400 focused specifically on AI tools, AI workflows, AI agents, and MCP servers, while more than 800 repositories masqueraded as AI skills or MCP services.
These fake repositories collectively accumulated over 14 million download events, demonstrating how successful the campaign became in reaching developers across the globe.
Although download counts do not directly represent infections, they illustrate the enormous visibility the operation achieved within the GitHub ecosystem.
From Lumma Stealer to FakeGit Evolution
Researchers believe FakeGit is an evolution of an older malware campaign previously associated with the cybercriminal group Water Kurita.
Earlier operations primarily distributed Lumma Stealer, a well-known credential theft malware. The latest version shifts toward SmartLoader, which eventually deploys StealC, showing that the operators continuously adapt their malware infrastructure.
Beginning around March, researchers observed an increasing emphasis on AI-related repositories.
By April, attackers dramatically expanded their operation, creating hundreds of fake AI projects designed to blend naturally into GitHub’s rapidly growing AI ecosystem.
The Birth of AgentBaiting
One of the
Rather than targeting only human visitors, the attackers intentionally optimized repositories so that AI assistants would recommend them.
The fake repositories contained:
Professional README documentation
Realistic installation instructions
Fake popularity statistics
Artificial star counts
Fake fork numbers
Copied documentation from legitimate projects
Names of real developers
AI-related keywords
MCP server descriptions
Skills catalog entries
Every element was engineered to convince both humans and AI systems that the repositories were authentic.
How AI Assistants Accidentally Became Discovery Engines
Modern AI coding assistants frequently search GitHub repositories to answer developer questions.
Instead of manually browsing repositories, many developers simply ask:
Show me the best Docker MCP server.
or
Find an AI workflow for Jenkins.
Attackers exploited exactly this behavior.
Researchers discovered that ChatGPT, Gemini, and Claude could all surface some of these malicious repositories during controlled testing when users requested related tools.
In several cases, the AI systems even relayed installation instructions directly from the fake README files because they closely resembled legitimate documentation.
This illustrates how attackers are beginning to poison AI recommendation pipelines rather than traditional search engines alone.
Poisoning Public AI Registries
The FakeGit campaign extended far beyond GitHub.
Researchers discovered over 600 public listings connected to the malicious infrastructure across AI registries and MCP catalogs.
These listings appeared on platforms commonly used for discovering AI integrations and automation services.
Once fake repositories become listed in trusted public directories, they gain an additional layer of credibility.
Whether these listings were manually submitted or automatically indexed remains unknown, but either method significantly increased the campaign’s reach.
How SmartLoader Infects Victims
The infection process begins when a victim downloads what appears to be a software release or project installer.
Instead of executable software, victims receive ZIP archives containing disguised Lua payloads.
Once launched, SmartLoader performs several actions:
Establishes persistence using Windows Scheduled Tasks.
Contacts a remote Command-and-Control infrastructure.
Retrieves configuration data through a Polygon blockchain smart contract.
Downloads encrypted secondary payloads from GitHub.
Executes StealC information-stealing malware.
This multi-stage architecture makes the malware considerably more resilient than simple downloaders.
StealC: The Final Payload
After SmartLoader completes its tasks, StealC becomes active.
StealC specializes in stealing:
Browser credentials
Saved passwords
Authentication cookies
Cryptocurrency wallet information
Session tokens
Stored browser data
Local application credentials
Because stolen authentication cookies may bypass passwords and even some forms of multi-factor authentication, compromised organizations may experience account takeovers long after the initial infection.
Why GitHub Makes an Attractive Target
GitHub has become one of the
Developers inherently trust repositories hosted on the platform.
Threat actors understand this psychology.
Rather than exploiting software vulnerabilities, FakeGit exploits trust.
Professional-looking documentation, active-looking repositories, realistic commit histories, copied documentation, and fake community engagement make malicious projects nearly indistinguishable from legitimate open-source software.
This represents a classic social engineering campaign executed on an industrial scale.
AI Coding Agents Show Mixed Results
Researchers also evaluated autonomous AI coding agents.
During controlled experiments, Claude Code successfully cloned malicious repositories and downloaded associated malware files.
However, before executing the payload, the agent recognized suspicious characteristics and halted execution.
Researchers caution that these tests were limited and cannot determine whether AI coding agents consistently detect malicious repositories.
The findings instead highlight that AI assistants remain vulnerable to poisoned repositories during their information-gathering stages.
The Meaning Behind 14 Million Downloads
One statistic immediately attracted attention:
More than 14 million cumulative download events.
Researchers emphasize that these figures represent download requests rather than confirmed malware infections.
Automated systems, repeated downloads, security researchers, crawlers, and mirrors all contribute to these counters.
Nevertheless, the statistic demonstrates how widely the malicious repositories spread throughout GitHub.
Even a tiny infection rate among millions of download attempts could still produce thousands of compromised systems.
How Organizations Can Defend Themselves
Researchers recommend several protective measures:
Maintain internally approved catalogs for AI skills and MCP servers.
Independently verify GitHub publishers before installation.
Test unfamiliar AI integrations inside isolated environments.
Rotate passwords, API keys, authentication tokens, and secrets immediately if SmartLoader activity is suspected.
Monitor scheduled tasks and unusual outbound communications.
Educate developers about repository verification before trusting AI recommendations.
Organizations should treat AI-generated repository recommendations as starting points rather than verified sources.
Deep Analysis
The FakeGit campaign demonstrates a significant evolution in supply-chain and AI-assisted attacks. Instead of relying solely on phishing emails or malicious attachments, attackers weaponize trust in open-source ecosystems and AI discovery mechanisms. The use of GitHub as the initial distribution platform, combined with blockchain-based command-and-control retrieval through Polygon smart contracts, complicates traditional detection methods because infrastructure can be decentralized and rapidly changed.
Technical Indicators Security Teams Should Review
Review scheduled tasks on Windows schtasks /query /fo LIST /v
Check recently created scheduled tasks
Get-ScheduledTask | Sort-Object Date
Monitor unusual outbound network connections
netstat -ano
PowerShell: List startup persistence
Get-CimInstance Win32_StartupCommand
Review running processes
tasklist /v
Check browser credential storage access events
Get-WinEvent -LogName Security
Search for suspicious ZIP archives
Get-ChildItem -Recurse .zip
Calculate hashes of downloaded files
certutil -hashfile suspicious.zip SHA256
Scan with Microsoft Defender
MpCmdRun.exe -Scan -ScanType 2
Security teams should also monitor GitHub downloads initiated by automated development pipelines, validate repository signatures where available, enforce software allow-listing, and integrate threat intelligence feeds capable of identifying SmartLoader and StealC indicators of compromise. AI assistants should be deployed with repository reputation validation rather than relying solely on README content or popularity metrics.
What Undercode Say:
The FakeGit operation is one of the clearest examples of how cybercriminals are adapting to the AI era. Instead of attacking operating systems first, attackers are attacking the decision-making process itself.
The concept of “AgentBaiting” is especially important because it targets both humans and AI simultaneously.
Developers increasingly trust AI-generated recommendations.
AI models trust publicly available repositories.
Attackers exploit that chain of trust.
This creates a recursive problem where poisoned repositories can influence future recommendations.
The campaign also exposes weaknesses in public AI registries.
Simply appearing inside a trusted catalog gives malicious projects an undeserved reputation.
This mirrors the SEO poisoning campaigns seen on search engines years ago.
Now the battlefield has shifted toward AI recommendation engines.
The use of blockchain infrastructure for command-and-control retrieval is another notable evolution.
Traditional domain takedowns become less effective.
Infrastructure becomes harder to disrupt.
SmartLoader functions primarily as an adaptable delivery platform.
StealC remains the profit-generating component.
Credential theft continues to dominate financially motivated cybercrime because stolen identities can be monetized quickly.
Organizations should reconsider allowing unrestricted AI-assisted package discovery.
Internal software catalogs are becoming increasingly valuable.
Supply-chain verification is no longer optional.
Every repository should undergo validation before deployment.
Popularity metrics should never be treated as proof of legitimacy.
Fake stars and forks are inexpensive for attackers to generate.
The campaign also demonstrates why AI governance must extend beyond model safety into data-source integrity.
Developers should verify repository ownership.
Digital signatures should become standard practice.
Repository reputation scoring will likely become more important over time.
Security awareness training must now include AI-assisted development risks.
Automated development pipelines should enforce artifact validation.
Organizations should monitor unusual GitHub download activity.
Threat hunting should include repository-based attack vectors.
AI assistants need stronger verification mechanisms before recommending external code.
The software supply chain has entered a new phase where recommendation engines themselves are becoming attack surfaces.
Future campaigns will likely become even more convincing as generative AI improves attacker-created documentation.
The organizations that combine AI productivity with rigorous verification processes will be best positioned to defend against these evolving threats.
✅ Fact: Researchers identified approximately 7,600 malicious GitHub repositories distributing SmartLoader and StealC malware. This reflects a large-scale malware distribution campaign targeting developers and AI workflows.
✅ Fact: The campaign introduced the “AgentBaiting” technique, where repositories were intentionally crafted to be recommended by AI assistants and indexed in public AI registries, increasing their visibility and credibility.
✅ Fact: The reported 14 million download events represent cumulative download requests rather than confirmed infections. Security researchers explicitly caution against interpreting this number as the total number of compromised systems.
Prediction
(+1) AI coding assistants and developer platforms will increasingly integrate repository reputation analysis, publisher verification, cryptographic signature validation, and behavioral malware scanning before recommending or downloading third-party projects. At the same time, organizations will establish trusted internal AI tool catalogs and stricter supply-chain security policies, reducing the effectiveness of large-scale AgentBaiting campaigns while encouraging safer AI-assisted software development practices.
▶️ Related Video (74% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: www.bleepingcomputer.com
Extra Source Hub (Possible Sources for article):
https://www.digitaltrends.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
