FakeGit Campaign: A New Era of AI-Driven Supply Chain Attacks
In July 2026, cybersecurity researchers uncovered the 'FakeGit' campaign, involving nearly 7,600 malicious GitHub repositories. Over 800 of these repositories masqueraded as artificial intelligence (AI) skills or Model Context Protocol (MCP) servers, distributing the SmartLoader malware. Attackers employed tactics such as cloning legitimate projects, creating deceptive developer profiles, and crafting convincing README files to lure users into downloading malicious ZIP files. Once executed, SmartLoader established persistence on compromised systems and deployed secondary payloads like StealC, an information stealer capable of harvesting extensive data. This incident underscores the evolving threat landscape where attackers exploit trusted platforms and emerging technologies. The 'AgentBaiting' technique, wherein AI agents inadvertently discover and propagate malicious repositories, highlights the need for enhanced vigilance in AI-assisted operations. Organizations must implement robust security measures to detect and mitigate such sophisticated supply chain attacks.
Kill Chain
