FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware

Cybersecurity researchers have discovered nearly 7,600 malicious GitHub repositories, out of which more than 800 pose as artificial intelligence (AI) skills or Model Context Protocol (MCP) servers to deliver a malware family known as SmartLoader as part of an ongoing campaign codenamed FakeGit. "FakeGit uses copied projects, lookalike developer profiles, convincing READMEs, and malicious ZIP

According to the report, the FakeGit campaign created around 7,600 malicious GitHub repositories, with over 800 masquerading as AI "skills" or Model Context Protocol (MCP) servers that deliver the SmartLoader malware and follow-on payloads like Lumma Stealer.[1][4] These repos copy legitimate projects, use lookalike developer identities, and ship malicious ZIP files instead of real code, turning GitHub into an abused software distribution channel.[1][3][4] From a RealGround perspective, this represents a critical AI supply chain risk: organizations integrating third-party skills, MCP servers, and agent plugins into AI agents may unknowingly onboard malware into development and production workflows. Security teams should treat Skills/MCP servers as software supply chain components, maintain an approved catalog, enforce publisher and repo verification, use sandbox analysis for new capabilities, and incorporate these checks into SBOM and CI/CD governance to prevent poisoned AI integrations from reaching production.[1][4][5]