FakeGit autonomous IA agents transform GitHub into malware vector

Cybersecurity researchers have identified a massive campaign that takes advantage of GitHub as a distribution platform: almost 7,600 malicious repositories created by about 6,600 profiles, of which more than 800 are passed on to IA's "skills" or to servers of the so-called Model Context Protocol (MCP) to deliver an initial charger known as SmartLoader which in turn instates information thieves like StealC. The disturbing thing is not only quantity, but mechanics: counterfeit or cloned projects, profiles that mimic legitimate developers and convincing README that induce clogged ZIP file downloads that activate a LuaJIT-based load chain to run osfuscated code.

The campaign, called FakeGit by the researchers, has exploited the real demand for IA integrations and tools - from Gmail and WhatsApp connectors to profits for Jenkins, Docker and Databricks - and has achieved more than 14 million downloads through GitHub Release's assets in a few campaign repositories. Functional appeal and familiarity with real names and workflows were sufficient to legitimize the download of the malicious ZIP.

More alarming is the evolution called AgentBaiting: autonomous IA agents (the "assistants" who seek and install skills or MCP servers) can discover these repositories for themselves, read README as if it were authentic documentation and execute malicious instructions without human intervention. Evidence indicates that models such as Anthropic Claude Code, Google Gemini and OpenAI ChatGPT can be misled to expose or recommend these repositories, which transforms a human-oriented social engineering technique into a vector that operates on a scale and without supervision.

This paradigm shift has serious implications for software security and trust in public records. When the search and installation is done by an agent, all the traditional defenses that depend on the human review stop working. In addition, the presence of these devices in markets and public listings (LobeHub, Glama, MCP.so, MCP Market, etc.) adds a layer of apparent legitimacy that makes detection difficult and increasing reach.

Defenses must act on multiple fronts. At the operational level, organizations should create and maintain a verified catalogue of skills, MCP servers and approved supplements, test any new agent capacity in isolated environments and apply the principle of minimum privilege to accounts and agents that can download or run code. It is essential to require code signatures and reproducible artifacts, to implement policies that block automatic discharges and executions by agents and to audit real-time execution and exfiltration routes with EDR and egress control.

Public developers and repositories also have responsibility: the adoption of supply chain integrity practices (e.g., signing releases, providing SBOM and following frames like SLSA) reduces the likelihood that malicious devices will circulate as if they were legitimate. The platforms that host records of skills and MCP should introduce minimum processes of identity and reputation verification, automated scanning of devices and clear channels to report and remove suspicious lists.

A model providers should limit the ability of agents to execute actions without restrictions, implement source validations before returning links or instructions involving code execution and expose administrative controls that restrict automated installation searches and operations. Governance over "agenic pathways" - the routes an agent comes to download and execute an artifact - must become an operational priority.

For technical and risk-responsible equipment, the immediate actions recommended are clear: to establish allowlists and review processes, to sandbox new integrations, to require signatures and metadata from source, to apply endpoints and network detection for SmartLoader / StealC patterns, and to educate users and administrators about the risk of blindly trusting agent results. Public-private collaboration and IOC exchange are also necessary to accelerate the identification and blocking of similar campaigns.

FakeGit did not force a complex technical break: it took advantage of confidence, automation and volume. The lesson is double and urgent: on the one hand, the security of the supply chain must mature (require integrity and traceability); on the other, IA systems and markplaces that facilitate automation must design controls so that autonomy does not become a way to spread malware on a scale. More information on practices and guides to protect the software supply chain can be found in GitHub's documentation on supply chain security ( https: / / docs.github.com / en / code-security / supply-chain-security) and in defence initiatives against supply chain attacks such as SLSA ( https: / / slsa.dev /).