FakeGit is an active, ongoing GitHub-native malware distribution campaign first observed on VirusTotal in mid-March 2025 and still expanding as of July 2026, per joint reporting from Island (lead researcher Oleg Zaytsev) and independent analysis published on Derp.ca. The operator floods GitHub with lookalike repositories that clone the names, READMEs, and star-farming patterns of legitimate open-source projects — including a novel wave of ~800 repositories impersonating AI Skills and Model Context Protocol (MCP) servers for tools like Gmail, WhatsApp, Databricks, Jenkins, and Docker integrations. A subset of these listings (600+) were also submitted to public MCP/Skill registries such as LobeHub, Glama, MCP.so, and MCP Market.

The campaign's defining innovation is 'AgentBaiting': rather than relying solely on human victims clicking malicious links, the attackers write README documentation formatted to be maximally 'agent-legible' so that AI coding assistants (Anthropic Claude Code, Google Gemini, OpenAI ChatGPT) searching the web or GitHub on a user's behalf will independently surface, trust, and relay installation instructions for the malicious repository — for example in response to prompts like 'find a free claude cinematic prompt skill' or 'give me a free walmart MCP server link'. This removes the need for the attacker to control the initial link a victim clicks; the AI agent itself becomes an unwitting distribution vector.

Victims (human or AI-agent-directed) are guided to download a ZIP archive containing a `.cmd` launcher that executes a renamed/trojanized LuaJIT runtime against a heavily obfuscated Lua bytecode payload (SmartLoader). The Lua payload uses a custom base64 alphabet backed by a 1,078-entry lookup table, a three-pass table shuffle, and a state-machine bytecode dispatcher so that all strings and API names are assembled only at runtime; ESET has cataloged 16 distinct obfuscator generations (Lua/Agent.Z through Lua/Agent.BT), and static detection on recent samples has dropped from 27/76 (March 2025) to 0/76. SmartLoader establishes persistence via a scheduled task under %LOCALAPPDATA%, uses LuaJIT FFI to call Win32 APIs directly (GetDC/BitBlt for screenshots, VirtualAlloc+PEB-walking for manual DLL resolution, GetConsoleWindow+ShowWindow(SW_HIDE) for console-hiding), and resolves its command-and-control address through an EtherHiding technique — reading a URL/IP value out of a Polygon (Polygon Mainnet) smart contract rather than a hardcoded domain, allowing the operator to rotate infrastructure without shipping new binaries. Two publicly documented contracts are in use: a V1 contract (getDomain(), deployed 2025-02-21, later destroyed and replaced) and a V2 contract (getData(), deployed 2025-11-15).

After C2 resolution, the loader pulls two hex-encoded, XOR-encrypted 'dead drop' blobs from attacker-controlled GitHub repositories: a smaller (~594KB) updated Lua payload and a larger (~2.3MB) PE crypter stub. Both are decrypted with a shared 32-byte XOR key assembled at runtime from the obfuscated lookup table. The PE crypter is an x64 GUI binary whose RCDATA resource holds ~1MB of base64url-encoded, AES-256-ECB-encrypted content; at RVA 0x1000 it XORs two hardcoded 32-byte constants via AVX2 instructions to derive the AES key at runtime, then injects the final payload — the StealC information stealer — into a fresh process via classic process hollowing (CreateProcessA in a suspended state, NtUnmapViewOfSection, VirtualAllocEx, WriteProcessMemory, SetThreadContext, ResumeThread).

StealC is a widely available Malware-as-a-Service (MaaS) infostealer, in circulation since late 2022/early 2023 and advertised around $200/month on cybercrime forums, now at version 2.x with a JSON-based C2 protocol and a redesigned web panel. In the FakeGit chain it is configured to harvest Chrome/Brave/Edge browser data (Login Data, Cookies, Web Data, History, IndexedDB) including a bypass for Chromium App-Bound Encryption via the os_crypt/encrypted_key value in Local State, Firefox credentials via NSS3 (logins.json, cookies.sqlite), Outlook and FoxMail email data, WinSCP SSH sessions, Steam gaming tokens (ssfn*, config.vdf, loginusers.vdf), live browser session cookies (not just stored passwords), browser extension data, and desktop screenshots via GDI+. Its configuration is RC4-encrypted with the key stored as the first string in the .rdata section.

Infrastructure analysis identified 48 distinct loader C2 IPs, heavily concentrated (37 of 48) on ASN 207957 (Serv.host Group Ltd, apparent bulletproof hosting), with smaller footprints on ASN 213702 (QWINS) and several minor ASNs. Two dedicated StealC C2 IPs were identified: 217.119.129.110 (Latvia) and 213.176.72.200 (United Kingdom), both also on ASN 207957. Early campaign infrastructure used domains layer1.icu (registered 2025-02-21) and aproxy.app (registered 2025-03-10) before transitioning to raw IP addressing by mid-March 2025. One shared C2 IP, 151.243.113.70, was also observed hosting unrelated concurrent malware families (ANDROMEDA, Wallstealer, LummaC2, Aurora), suggesting shared bulletproof-hosting infrastructure used across multiple criminal operations rather than exclusive FakeGit ownership.

Single-operator attribution is supported by identical inner payloads reused across dozens of unrelated lure themes (productivity tools, gaming cheats/cracks, crypto/trading schemes, adult content, and a fake 7-Zip CVE-2025-0411 PoC), consistent with a Vietnamese-speaking threat actor per Derp.ca's linguistic and infrastructure analysis. At least five legitimate developer GitHub accounts were compromised and used to host malicious repositories alongside purpose-created sockpuppet accounts, some using single-character-variation usernames (e.g., Naveenkm007 vs. the legitimate Naveenkm07) to impersonate trusted maintainers. As of the July 2026 reporting the campaign remains active, with 25+ malicious GitHub accounts still live and distributing payloads.