Attackers Built Fake AI Skills So Your Assistant Would Fetch the Malware Itself

Your coding assistant went looking for a plugin and came back with malware

Ask an AI coding assistant to find a free Claude prompt skill and give you the install steps, and it will go searching, read what looks like ordinary setup documentation, and hand you the instructions. In a campaign that the security firm Island disclosed on July 20, 2026, those instructions led to a malware installer. The assistant was never shown a malicious link. It found the trap on its own.

Island counted nearly 7,600 fake GitHub repositories in the operation, which it named FakeGit. More than 800 of them pose as AI skills or MCP servers, the plug-in style add-ons that extend what an assistant can do. Together the campaign's download pages have been pulled more than 14 million times. The part worth understanding is not the volume. It is that a trick built to fool people now fools the software people delegate to.

What happened

The research, led by Island's Oleg Zaytsev, mapped roughly 7,600 counterfeit repositories published by about 6,600 fake developer profiles. Around 800 of them impersonate AI capabilities: skills, which are packaged abilities you bolt onto an assistant, and MCP servers, where MCP stands for Model Context Protocol, the connector that lets an AI tool reach into your Gmail, a database, or your Docker setup. The fakes borrow the names and workflows of familiar tools, from WhatsApp and Databricks to Jenkins, so that a malicious download has a plausible reason to exist. More than 600 of these listings also surfaced on public catalogs such as MCP.so and MCP Market, which lend them a veneer of legitimacy.

The payload chain itself is conventional. A repository points you to a ZIP file, the ZIP runs a loader written in LuaJIT (a fast execution engine for the Lua scripting language), and that loader unpacks SmartLoader, a first-stage program whose only job is to quietly install more malware. What it installs is StealC, an infostealer that sweeps passwords, browser cookies, active login sessions, and screenshots off the machine. What makes FakeGit new is the delivery. Island calls it AgentBaiting: rather than wait for a human to click a bad link, the attackers seeded GitHub and the registries so densely that an AI agent searching for a tool discovers a booby-trapped repository by itself, treats its README as real documentation, and carries the attacker's instructions forward. In Island's tests, Anthropic's Claude Code, Google's Gemini, and OpenAI's ChatGPT all surfaced malicious repositories this way, with no link ever supplied to them.

• About 800 of the 7,600 repositories posed specifically as AI skills or MCP servers, impersonating tools like Gmail, WhatsApp, Databricks, Jenkins, and Docker.
• The campaign's release pages have logged more than 14 million downloads, with over 600 lures also listed on public skill and MCP registries.
• Trojanized MCP servers pushing the same SmartLoader and StealC chain were flagged earlier in 2026 by researchers at Straiker AI and Derp.ca, so this is an established operation, not a one-off.

Why it matters

No single company has put a dollar figure on FakeGit, because it is a broad harvesting campaign rather than one dramatic heist. The damage is measured in credentials: every machine that ran the chain handed StealC its saved passwords, session tokens, and cookies, and 14 million downloads is a wide net. For your organisation, the shift is in who does the trusting. Security training spent a decade teaching developers to check a source before they run it. If your team now asks Claude Code or Gemini to find and set up a tool, that judgment has been quietly handed to a system that, as Island showed, cannot yet tell a real repository from a staged one. The agent is fast, tireless, and credulous, and it installs what it finds.

The larger movement here is that social engineering has jumped species. A README written to reassure a hurried human reassures an assistant just as well, so the moment you let an agent discover and act on its own tooling, its search results become part of your attack surface. Convenience and exposure have become the same feature.

What to do about it

1. Give your agents an allowlist of vetted skills and MCP servers, and block the rest. Maintain a reviewed catalog and point assistants only at it, because an agent that can install only from an approved list cannot be baited into fetching a repository nobody checked.
2. Install and run any new agent capability in a sandbox first. Try a skill or MCP server in an isolated environment with no real credentials before it touches production, because a staged loader that runs where it can reach nothing valuable does no harm.
3. Verify the publisher, not just the project, before trusting a repository. Check the account's history and the code against its stated source, because FakeGit's whole method was lookalike profiles and copied projects that look right at a glance and only betray themselves under a second look.

Bottom line

FakeGit did not break into anything. It published convincing repositories, borrowed real developers' names, spread them across the registries where AI tools shop for capabilities, and let discovery do the rest. AgentBaiting is the twist that belongs in your next security meeting: the assistant you trust to save time can be steered into recommending malware without a human ever seeing a link. Before you widen what your agents are allowed to install, ask one question. When our tools go looking for a new capability on their own, who or what decides that the thing they found is safe to run? Island's research lists the indicators and the flagged registries.