FakeGit floods GitHub with fake AI skills and MCP servers that drop malware

Researchers at Island uncovered FakeGit, a campaign running roughly 7,600 malicious GitHub repositories from about 6,600 lookalike developer profiles, of which more than 800 pose as AI skills or Model Context Protocol servers. The fake projects borrow the names and workflows of familiar tools, covering Gmail and WhatsApp integrations through to Databricks, Jenkins, and Docker tooling, and their convincing README files walk a user or an agent from routine setup into downloading a malicious ZIP. That triggers a loader chain ending in SmartLoader, which establishes persistence and pulls further payloads such as the StealC infostealer.

Check

Treat AI skills and MCP servers on GitHub as untrusted code: verify the publishing account and project history before installing, and be wary of setup steps that download a ZIP release.

Affected

Developers and AI agents installing skills or MCP servers from GitHub; more than 800 fake repositories impersonate familiar tools, and following their setup instructions leads to SmartLoader and the StealC infostealer.

Fix

Install AI skills and MCP servers only from verified publishers, review repository history and profile age, scan packages before use, and restrict what credentials and systems an installed MCP server can reach.