"AgentBaiting": 7,600 Fake GitHub Repositories, 800+ Posing as AI Skills and MCP Servers, Deliver SmartLoader

Developers and, more precisely, the AI agents searching on their behalf for skills and MCP servers to install

Island documented a campaign it calls AgentBaiting, built on the FakeGit repository network: roughly 7,600 malicious GitHub repositories published from about 6,600 profiles, of which more than 800 impersonated AI Skills or MCP servers, with malicious projects surfacing more than 600 times across public AI registries and catalogs. The AI-focused wave built through March and peaked in April 2026, and GitHub Release assets across the network had logged more than 14 million downloads by July. The repositories build credibility with copied projects, lookalike accounts, plausible READMEs, and modest engagement numbers, with one lure copying the name and positioning of a popular Claude Skills collection. Malicious ZIP archives deliver SmartLoader, which establishes persistence and installs the StealC infostealer to take credentials, active sessions, and other sensitive data. The distinguishing detail is the targeting: Island's tests showed Claude Code, Google Gemini, and OpenAI ChatGPT surfacing campaign repositories on their own, without being shown a link, so an agent asked to find a skill can select and install the attacker's package with no human ever evaluating it

Repository credibility signals, stars, README quality, contributor history, are cheap to manufacture and are exactly what a retrieval-driven agent scores when choosing what to install. Search-and-install with no human in the middle turns a squatting campaign into an execution path