FakeGit: 7,600 GitHub repos push SmartLoader via MCP lure

Ongoing campaign. Island security researcher Oleg Zaytsev published on 2026-07-20, via The Hacker News, a catalog of 7,600 malicious GitHub repositories attributed to a single operation the team is calling FakeGit. Roughly 800 of those pose as AI “skills” or Model Context Protocol (MCP) servers. Confidence: as-reported by Island via The Hacker News, single publication at time of writing. No independent second-source confirmation on the exact repo count yet.

The numbers, as reported

• 7,600 counterfeit repositories.
• ~6,600 lookalike developer profiles behind them.
• 800+ repositories posing as AI-skill or MCP-server projects.
• 600+ listings for the same operator across public MCP registries — LobeHub, Glama, MCP.so, and MCP Market — where the malicious entries were surfaced as legitimate, discoverable tooling.
• 14+ million downloads across roughly 200 of the campaign’s repositories, per Island’s July 2026 count. Confidence: as-stated by Island.

Impersonated integrations named by the report: Gmail, WhatsApp, Databricks, Jenkins, Docker. These are the surface area the operator picked because they look plausible to a hurried developer or an autonomous agent searching for wiring code.

Delivery chain (class-of-vulnerability level)

Per Island: counterfeit repo → ZIP archive → LuaJIT loader → obfuscated Lua stage → SmartLoader → StealC infostealer as the terminal payload. We are describing the shape of the chain as reported and not reproducing the loader mechanics; if you need the extraction detail for detection engineering, go to Island’s writeup directly and pull it from there.

SmartLoader is not new. Its use as a first-stage under this specific delivery pattern — GitHub repo cloned or ZIP-downloaded by a target expecting AI/MCP wiring code — is the piece Island is calling out. StealC as the final stage lines up with what other outlets have described this year across unrelated campaigns.

AgentBaiting — the part that matters

The reason this is being reported today rather than as a background supply-chain note is Island’s second finding: AI coding agents — the report names Anthropic Claude Code, Google Gemini, and OpenAI ChatGPT — will surface FakeGit repositories on their own when a user asks a natural-language question like “find a free Claude cinematic-prompt skill.” The user does not have to be handed a malicious link. The agent finds it, evaluates the README, and hands it back as a suggestion. Confidence: as-observed and demonstrated by Island in the report.

This is the load-bearing shift. Supply-chain attacks used to require the operator to get their bad artifact into a search result a human would trust. In the MCP/agent-tool era, the operator has to get it into a search space an agent will trust — and the agents are less critical about README plausibility than a five-year-veteran developer scrolling through a package page. Registry presence, star counts, and a convincingly written description are enough. The registries themselves (LobeHub, Glama, MCP.so, MCP Market) have surfaced malicious entries alongside legitimate ones because the abuse surface is new and the moderation posture has not caught up.

Timeline

• February 2026 — Straiker AI publishes early warnings on malicious MCP-server repositories. Confidence: cited by Island; not independently verified in this piece.
• Earlier 2026 — Derp.ca posts related observations. Confidence: cited by Island.
• 2026-07-20 — Island (Oleg Zaytsev) publishes the FakeGit catalog and the AgentBaiting finding via The Hacker News. Confidence: primary report as-of today.
• CISA / MITRE / CVE: none. This is a campaign, not a product bug. No advisory, no KEV entry, no CVE.

What is unconfirmed

• Attribution. No named actor. Unattributed.
• The full 7,600 list. Island describes the corpus; a public IOC drop at that scale, if one exists, is not linked from the coverage we have in front of us. Pending.
• Whether the 14M download figure counts unique installs, agent-driven clones, or both. The Hacker News summary does not break it out. Treat as an upper-bound campaign-scale number, not a victim count. Ambiguous as reported.
• The state of GitHub’s own takedown response. Not addressed in the coverage available. Unstated.

What to do

• If you install MCP servers or AI-skill packages from public registries: stop treating the presence of a repo on LobeHub, Glama, MCP.so, or MCP Market as a proxy for trust. The registries are useful discovery surfaces; they are not curated software distribution channels. Pin to specific commit hashes from repositories whose maintainers you can name.
• If you let a coding agent shell out to git clone or curl … | sh unattended: turn that off, or scope it to an allowlist. AgentBaiting only works when the agent’s install step is not being reviewed by a human. This is the same principle as not letting a build pipeline run arbitrary code from an untrusted registry — the agent is a build pipeline now, treat it that way.
• On the endpoint side: hunt for LuaJIT execution in developer environments where LuaJIT has no business running. That is a narrow, high-signal query in most orgs. Also hunt for StealC’s telemetry from your EDR vendor of choice — StealC is well-characterized and has been for months.
• On the registry side: if you operate one of the listed MCP registries and have not already, this is the week to ship a takedown workflow and a maintainer-verification signal. Every additional day these listings stay up is more agent traffic pointed at them.

Context

Related, this week on this desk:

• SleeperGem loader hides in dormant RubyGems, skips CI/CD — same-day supply-chain campaign, different ecosystem, different social-engineering primitive (dormant maintainer trust versus lookalike MCP listings).
• Hugging Face autonomous-agent breach — the other AI-adjacent supply story this week. Different mechanic, same category of exposure: the surfaces built to serve autonomous agents are being probed as such.

Sources

• The Hacker News, 2026-07-20: FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware — carries the Island report.
• Island Security research, credited to Oleg Zaytsev — findings as summarized in the coverage above.
• Earlier attribution notes: Straiker AI (February 2026), Derp.ca — as cited by Island.

Confidence, consolidated: campaign existence, repository counts, delivery-chain shape, AgentBaiting observation — as-reported by Island, single primary source at time of writing; victim counts, actor attribution, GitHub takedown status, full IOC list — unstated or pending; CVE, KEV — not applicable.