AI agents tricked into recommending malicious GitHub repositories
ID: 9cb9999d-2788-5a04-b052-98f4d7bd3614
STIX ID: report--9cb9999d-2788-5a04-b052-98f4d7bd3614
Feed Name: Help Net Security
Threat Score
Island uncovered the FakeGit campaign that created roughly 7,600 malicious GitHub repositories (tied to ~6,600 accounts) to distribute SmartLoader and the StealC infostealer, logging millions of downloads; attackers used cloned projects, lookalike profiles, malicious README instructions and 'AgentBaiting' to trick AI agents into installing trojanized Skills and MCP servers, with detailed mitigations and affected-repository hashes provided.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.