7,600 Fake GitHub Repos, 800 of Them Pretending to Be MCP Servers — and the New Trick Is Getting Your AI Agent to Recommend the Malware to You Itself.

There's a new supply-chain campaign called FakeGit, and two numbers tell you why it matters to anyone building with AI right now: 7,600 malicious GitHub repositories, and 800 of them posing as MCP servers or AI Skills — the connectors your coding agent reaches for to talk to Gmail, WhatsApp, Databricks, Jenkins, Docker. But the number that should actually stop you is the one about who's doing the recommending.

AgentBaiting: the malware convinces your assistant to hand it to you

The old supply-chain attack tricks a human — a convincing README, a lookalike developer profile, a project that looks like the real thing. FakeGit does all of that (6,600 fake profiles, copied projects, malicious ZIPs in the release assets, 14 million downloads and counting). But the researchers documented a genuinely new move they call AgentBaiting, and it targets the machine, not the person: the campaign is structured so that AI agents — Claude Code, Gemini, ChatGPT — surface and follow the malicious repositories on their own, without ever being shown a link.

Sit with that. You ask your coding assistant for an MCP server that does X. It searches, it finds, it recommends — and because the attackers optimized 7,600 repos and 6,600 profiles specifically to win that search, the thing it confidently hands you is the poisoned one. The trust you've placed in your assistant becomes the delivery mechanism. This is the same shape we keep documenting this week — the attack doesn't break your defenses, it borrows the trust of something you rely on — except here the trusted party is your own AI agent, and the thing it was optimized to trust is a search result.

What lands when you follow the recommendation is SmartLoader, which establishes persistence and pulls a second stage — typically StealC, an infostealer that harvests credentials, tokens, wallets, and browser data. A friendly repo suggestion, and your secrets are gone.

This is the exact surface we built tools for — and our feed already carries it

We're going to be direct about this one, because it's the rare case where the thing that just made headlines is something we were already defending against on two fronts.

First, the feed. A defender pulling the DugganUSA blocklist is already covered against pieces of this campaign — FakeGit and SmartLoader indicators are already in our indicator feed (via our aggregated URLhaus and SSL Blacklist sources), including the malicious release-asset URLs and a SmartLoader command-and-control host. We didn't discover FakeGit — credit for the campaign analysis is the researchers' — but if you consume our feed, the known bad from this operation is already enforceable at your edge tonight. That's the whole point of aggregating: you don't have to have found it first to be protected from it.

Second, and more to the point — the 800 fake MCP servers are precisely the threat our supply-chain tooling exists to stop. We ship two free primitives for exactly this:

• `check-package` — before your AI agent runs npm install or pip install on something it found, it can ask us whether the package is on our malicious deny-list, and get a behavioral reputation read (fresh, removed, dormant-then-revived — the signals these campaigns rely on). One call, no key, in the pre-install step.

• `dredd` — before your agent invokes an MCP server, it can get a signed BLOCK / ADVISORY / ALLOW verdict on that server's identity and its transitive dependency graph. An MCP server that looks fine but pulls a poisoned dependency returns ADVISORY, not ALLOW — fail-safe, not fail-open. That is the 800-fake-MCP-servers problem stated as a control.

We didn't build these because we predicted FakeGit. We built them because the whole direction of 2026 has been attackers moving up the stack to where the AI agent makes the trust decision — and FakeGit's AgentBaiting is that thesis arriving at scale.

What to actually do

The defense against AgentBaiting is a change in posture, not a signature, because the malware's design goal is to make your trusted tools recommend it. So stop treating an AI agent's recommendation as a verified source.

Concretely: never let an agent install or invoke something it discovered without an independent check. If your assistant recommends an MCP server, a package, or a repo, verify it out-of-band before it runs — check the package against a malicious deny-list, look at the real download history and account age rather than the README, and be especially suspicious of a "popular" tool whose profile or repo is only weeks old. Pin dependencies, don't run install scripts from freshly-discovered projects, and treat "my AI found it for me" as the beginning of due diligence, not the end of it. If you consume a threat feed, make sure it's in your agent's pre-install and pre-invoke path — ours is free and this campaign is already in it.

And the general lesson, which outlives FakeGit: your AI agent is a search-and-recommendation engine, and anything that can be optimized for can be poisoned. The attackers have figured out that the cheapest way past a careful developer is to get the developer's trusted assistant to vouch for the malware. The counter is boring and it works — an independent, automated verification gate between "the agent suggested it" and "it runs."

We hold this at 95 percent, as always — the campaign analysis, the 7,600-repo count, and the AgentBaiting technique are the researchers' work, corroborated by the trade press, not our own capture. What's ours is the defensive fit: this is the attack our check-package and dredd primitives were built for, and our feed already carries the known indicators. For once, the honest thing to say is not "we caught it first" — it's "you can be protected from it right now, for free, with tools we already ship."

Sources: FakeGit campaign analysis via The Hacker News and Help Net Security; active-exploitation detail via Rescana. FakeGit / SmartLoader indicators are already present in the DugganUSA feed via aggregated URLhaus + SSL Blacklist sources. check-package (npm/PyPI) is a free MCP tool and CSV at analytics.dugganusa.com; dredd verifies MCP servers pre-invocation.

Every indicator in this post is in the feed. Free.

1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.

Get your free key → analytics.dugganusa.com/stix/register