FakeGit Campaign: Malicious GitHub Repos Impersonating AI Skills/MCP Servers Distributing SmartLoader
First seen Jul 21, 2026 · Updated Jul 21, 2026
Researchers identified roughly 7,600 malicious GitHub repositories, with over 800 masquerading as AI 'skills' or Model Context Protocol (MCP) servers, used to distribute the SmartLoader malware family in a campaign dubbed FakeGit. The attackers use copied projects, lookalike developer profiles, convincing READMEs, and malicious ZIP downloads to trick developers into executing malware, exploiting growing trust in AI/MCP tooling as a lure.
Technical Analysis
The campaign leverages GitHub's open publishing model to host thousands of repositories cloned from legitimate projects, with a subset specifically branded as AI agent skills or MCP servers to capitalize on developer interest in AI tooling. Victims are lured via convincing README documentation and lookalike maintainer profiles into downloading ZIP archives that contain SmartLoader, a loader malware used to stage further payloads. The entry point is human trust in repository legitimacy rather than a technical vulnerability in MCP itself; once executed, SmartLoader gives attackers code execution on the developer's machine, potentially exposing credentials, CI/CD secrets, and further supply-chain pivot points. This crosses trust boundaries because MCP servers are often granted elevated tool/file/network access by design, meaning a poisoned or fake MCP server package could later be used for deeper agent-layer compromise if unwittingly integrated into an agentic pipeline.
Affected Systems
MCP servers (generic/unspecified), GitHub-hosted AI skill packages; protocols: MCP
Detection Signatures
- Repositories with high similarity to popular AI/MCP projects but low star/fork history and recently created maintainer accounts
- READMEs urging download of external ZIP files rather than standard package manager installation (pip/npm/cargo)
- ZIP archives containing obfuscated loader scripts or unexpected binaries alongside claimed 'MCP server' or 'AI skill' code
- Outbound network connections to uncommon C2 domains shortly after cloning/running a downloaded repo
- Mismatched or newly created GitHub developer profiles with minimal contribution history impersonating known maintainers
- Process execution of scripting engines (PowerShell, wscript, mshta) spawned from files extracted out of repo ZIP downloads
Remediation Steps
- 1
Vet MCP/AI-skill sources before install
Only install MCP servers or AI agent skills from verified publishers, official registries, or organizations with established reputations; avoid ZIP downloads from unofficial repos.
- 2
Sandbox execution of third-party repos
Clone and test unfamiliar repositories in isolated VMs or containers with no access to credentials, secrets, or production systems before trusting them.
- 3
Enforce package integrity checks
Use checksum/signature verification and dependency scanning tools to detect tampered or malicious archives before execution.
- 4
Monitor for loader malware indicators
Deploy EDR rules to detect SmartLoader behavioral patterns, including suspicious script interpreter chains and unexpected outbound connections after repo execution.
- 5
Educate developers on repo impersonation
Train engineering teams to recognize lookalike profiles, copied READMEs, and social-engineering lures targeting the AI/MCP ecosystem specifically.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.