AgentBaiting Uses 800 Fake AI Skills and MCP Servers to Spread SmartLoader

A malware campaign called AgentBaiting is using more than 800 fake AI Skills and Model Context Protocol servers to distribute SmartLoader through deceptive GitHub repositories.

The malicious projects imitate useful AI integrations for services such as Gmail, WhatsApp, Databricks, Jenkins, Docker, and Walmart. According to Island’s AgentBaiting investigation, some AI assistants also surfaced the repositories while independently searching for tools.

Victims who follow the accompanying instructions download Windows ZIP archives instead of legitimate AI capabilities. Running the included launcher activates SmartLoader, which can establish persistence and install the StealC information-stealing malware.

How large is the FakeGit malware operation?

Island connected AgentBaiting to FakeGit, a wider malware distribution operation built around convincing but fraudulent GitHub projects. Researchers identified approximately 7,600 malicious repositories created by around 6,600 profiles.

About 1,400 repositories related to AI tools, agents, or workflows. More than 800 specifically pretended to offer AI Skills or MCP servers for individual and enterprise use.

The AI-focused wave grew during March and peaked in April 2026, when attackers created almost 300 related repositories. Island also found more than 600 appearances across public AI registries and catalogs.

Campaign measurement	Island’s findings
Malicious GitHub repositories	Approximately 7,600
Profiles involved	Approximately 6,600
Repositories tied to AI tools or workflows	Approximately 1,400
Fake AI Skills and MCP servers	More than 800
Public registry appearances	More than 600
Measured GitHub Release downloads	More than 14 million across about 200 FakeGit repositories

FakeGit repositories imitate legitimate AI projects

FakeGit makes its repositories appear trustworthy by copying project descriptions, documentation, developer identities, and installation instructions. Some accounts use names that differ from established developers by only one character.

One repository imitated the popular ComposioHQ awesome-claude-skills project. The fake version accumulated dozens of stars and forks before presenting a SmartLoader ZIP archive as the project download.

Public engagement numbers do not prove that a repository is safe. Attackers can manipulate stars and forks, reuse documentation, or create several accounts to make a recently published project appear established.

• Copied names and descriptions from legitimate AI projects
• Lookalike usernames and developer profiles
• Professional README files with installation instructions
• Stars and forks intended to create credibility
• ZIP archives presented as installers or project releases
• Listings in public MCP and AI capability catalogs

How the SmartLoader infection begins

The fake Databricks MCP server documented by Island illustrates the infection process. Its README advertises an enterprise integration and directs users to download, extract, and run a Windows archive.

The archive does not contain an MCP manifest, Databricks installer, or functional server. Instead, it includes a command launcher, a renamed LuaJIT-style runtime, and an obfuscated Lua payload disguised as a text file.

Executing the launcher passes the hidden program to the runtime. Other FakeGit variants use different names, but researchers observed a similar combination of a launcher, renamed runtime, and concealed payload.

1. A user or AI agent discovers a fraudulent repository.
2. The repository README presents a malicious ZIP as a legitimate download.
3. The user extracts the archive and runs its command or batch launcher.
4. The launcher starts an obfuscated Lua payload through a renamed runtime.
5. SmartLoader creates persistence and retrieves additional encrypted stages.
6. Later stages inject the StealC information stealer into another process.

SmartLoader can install the StealC information stealer

Researchers found that related SmartLoader variants can hide their console windows and create scheduled tasks under the user’s local application data directory. Some variants locate command infrastructure through a value stored in a Polygon smart contract.

The malware can then retrieve encrypted stages from GitHub. These stages lead to a payload that injects StealC into another running process.

StealC targets browser passwords, cookies, active sessions, extension data, email credentials, remote-access credentials, screenshots, and information about the infected computer. Theft of active sessions means changing a password alone may not remove an attacker’s access.

Attack stage	Observed activity
Discovery	Fake repository appears in search results or AI registries
Execution	User runs a launcher from a downloaded ZIP archive
Persistence	SmartLoader can create scheduled tasks
Payload retrieval	Encrypted stages may be downloaded from GitHub
Credential theft	StealC targets passwords, cookies, sessions, and other sensitive data

What makes AgentBaiting different?

Traditional malware campaigns commonly send victims a malicious link through email, messaging platforms, advertisements, or compromised websites. AgentBaiting can reach users through an AI assistant’s own search process.

An agent searching for an AI Skill or MCP server may discover a fraudulent GitHub project, interpret its README as valid documentation, and repeat the attacker’s installation instructions.

In tests described in the Island research report, Claude Code, Gemini, and ChatGPT surfaced malicious campaign repositories without researchers first supplying a direct link.

The results were inconsistent. Claude Code recommended a legitimate project in one test but also treated a malicious repository as an alternative and repeated instructions that encouraged bypassing a Windows security warning.

In another test, Gemini returned a malicious Walmart MCP repository as its first suggestion. ChatGPT included the same repository among three public choices and selected it as a starting point.

These results do not mean that every search will return malware. They show that an AI-generated recommendation, like a conventional search result, does not establish that a repository or its files are trustworthy.

Public MCP registries expanded the campaign’s reach

Island found campaign-linked projects listed more than 600 times across LobeHub, Glama, MCP.so, and MCP Market. Researchers could not determine whether every listing was submitted manually or collected automatically.

Some registries reproduced the attacker-written README, including its download link and installation instructions. A registry listing can therefore repeat the malicious content instead of independently validating it.

The lures closely matched normal workplace tasks. Sixty-two percent of the malicious Skill and MCP repositories were positioned for enterprise or internal developer use, while almost two-thirds of the MCP lures claimed to connect cloud services, databases, or APIs.

• Email and messaging integrations
• Cloud service and database connectors
• Source code and build-system tools
• Analytics and operational data integrations
• Security, audit, and developer utilities
• Tools claiming to handle credentials or secrets

How organizations can reduce the AgentBaiting risk

Organizations should maintain a reviewed catalog of approved AI Skills, MCP servers, and agent plug-ins. Employees and agents should not install capabilities directly from unrestricted search results.

Teams should evaluate new capabilities in an isolated environment without browser sessions, production information, SSH keys, cloud credentials, or API tokens. A supposed Skill or MCP server delivered as an unexplained Windows executable deserves close scrutiny.

The official MCP security guidance recommends controls covering authorization, token handling, consent, and access to sensitive resources. Organizations should combine those controls with code review, publisher verification, endpoint monitoring, and least-privilege access.

1. Approve Skills and MCP servers through a documented review process.
2. Verify the publisher’s identity and project history.
3. Inspect source code, manifests, dependencies, and installation scripts.
4. Test new capabilities in a sandbox without production credentials.
5. Record the repository, commit, version, and package hash.
6. Monitor agent-initiated downloads, Git clones, and shell commands.
7. Require confirmation before agents execute code or change configurations.

A registry listing, star count, or polished README should not replace technical validation. The Model Context Protocol security recommendations also stress appropriate access controls around integrations that connect agents to sensitive services.

What to do after suspected SmartLoader execution

If someone ran a suspected FakeGit package, the organization should isolate the affected endpoint from its network. Security teams should preserve logs and inspect scheduled tasks, running processes, downloaded files, and recent command activity.

Response teams should revoke active browser sessions, OAuth grants, cloud tokens, API keys, SSH credentials, email sessions, and developer credentials associated with the computer. They should reset passwords after revoking sessions rather than relying on password changes alone.

Organizations can compare observed repositories and package hashes against Island’s AgentBaiting indicator dataset. The dataset maps malicious repository addresses to SHA-256 hashes for associated ZIP archives.

• Disconnect the suspected endpoint from the network.
• Preserve security logs and forensic evidence.
• Revoke browser sessions and OAuth authorizations.
• Rotate API tokens, cloud credentials, and SSH keys.
• Reset passwords after active sessions have been revoked.
• Search other systems for the same repositories, files, and hashes.

Representative AgentBaiting indicators of compromise

The following indicators come from Island’s published research. Repository names can help with historical searches, while SHA-256 hashes provide a more precise way to identify the documented ZIP packages.

Repository	Malicious archive	SHA-256
hfgwygey/yu-ai-agent	yu-ai-agent-1.0-beta.3.zip	216a2c99fd42c00f9323d8b16dd19f622f7f4778b2b1d7cf07a3de5621fd1546
Mann1988/awesome-claude-skills	awesome-skills-claude-3.3.zip	91e5dbfaf45edf25fbc2168f92083e05dfa427afa7633e991392e33cc7427dad
h4vzz/awesome-ai-agent-skills	agent_ai_awesome_skills_2.0.zip	498fe8fb806cd0e6685f97fc7d74de769dae5a28cdc821557b7585ad5ad83147
StanLeyJ03/mcp-for-security	for-security-mcp-3.3.zip	62744baa8077bb8be237647fd78e3bea2ca0932bf4be3d5618600f97118095f8
xbim08/awesome-claude-code-plugins	plugins_claude_awesome_code_2.4.zip	1da8df487d30b988f3c350c065206726aaa13f079a07151cd42ab5579994b9de
DomingosNgongo/walmart-mcp	mcp-walmart-2.2.zip	c15693106682f2ddb26649cab6e1962a64537627cde4c5d3c79d5a0be8c1b5a8
45d5r/databricks-mcp-server	server_databricks_mcp_1.6.zip	66afc7d87d10dbe392898c4e5c613e0442fabb396415c2bef3a5ef2ac752c5ad
MauManto/jenkins-mcp-server	mcp-server-jenkins-3.2.zip	a33f40cab1ab7f971d3464af3e7595918107332b9e83342007571842b9e22826
waynestimulative605/docker-mcp-gateway	gateway-docker-mcp-v1.6-alpha.5.zip	3c858facbad66f5479e2c4add171421dc1b6488b36f33e7cff073aba585954a7
lucaducapuca/alibabacloud-bigdata-skills	alibabacloud-bigdata-skills-v1.7.zip	fc1278f419e611bf40ca414099bfd9ad98a31ffb054371e8cb65a84849b00eaf

Island provides a broader collection of repository and archive indicators in its security research artifacts. Defenders should use the latest dataset because repositories can disappear and investigations may identify additional infrastructure.

FAQ