FakeGit Campaign Uses 7,600 GitHub Repositories with AgentBaiting to Spread SmartLoader & StealC Malware — Threadlinqs Intelligence
As of 2026-07-20, FakeGit Campaign Uses 7,600 GitHub Repositories with AgentBaiting to Spread SmartLoader & StealC Malware is a high-severity malware threat attributed to FakeGit Operator (unattributed, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 31 indicators of compromise.
Threat ID: TL-2026-1565 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: FakeGit Operator (unattributed · FINANCIAL
A large-scale, Vietnamese-speaking-operator campaign dubbed FakeGit has published roughly 7,600 malicious GitHub repositories (from ~6,600 fake profiles, 800+ posing as AI Skills/MCP servers) to
FakeGit is an active, ongoing GitHub-native malware distribution campaign first observed on VirusTotal in mid-March 2025 and still expanding as of July 2026, per joint reporting from Island (lead researcher Oleg Zaytsev) and independent analysis published on Derp.ca. The operator floods GitHub with lookalike repositories that clone the names, READMEs, and star-farming patterns of legitimate open-source projects — including a novel wave of ~800 repositories impersonating AI Skills and Model Context Protocol (MCP) servers for tools like Gmail, WhatsApp, Databricks, Jenkins, and Docker integrations. A subset of these listings (600+) were also submitted to public MCP/Skill registries such as LobeHub, Glama, MCP.so, and MCP Market.
The campaign's defining innovation is 'AgentBaiting': rather than relying solely on human victims clicking malicious links, the attackers write README documentation formatted to be maximally 'agent-legible' so that AI coding assistants (Anthropic Claude Code, Google Gemini, OpenAI ChatGPT) searching the web or GitHub on a user's behalf will independently surface, trust, and relay installation instructions for the malicious repository — for example in response to prompts like 'find a free claude cinematic prompt skill' or 'give me a free walmart MCP server link'. This removes the need for the attacker to control the initial link a victim clicks; the AI agent itself becomes an unwitting distribution vector.
Victims (human or AI-agent-directed) are guided to download a ZIP archive containing a `.cmd` launcher that executes a renamed/trojanized LuaJIT runtime against a heavily obfuscated Lua bytecode payload (SmartLoader). The Lua payload uses a custom base64 alphabet backed by a 1,078-entry lookup table, a three-pass table shuffle, and a state-machine bytecode dispatcher so that all strings and API names are assembled only at runtime; ESET has cataloged 16 distinct obfuscator generations (Lua/Agent.Z through Lua/Agent.BT), and static detection on recent samples has dropped from 27/76 (March 2025) to 0/76. SmartLoader establishes persistence via a scheduled task under %LOCALAPPDATA%, uses LuaJIT FFI to call Win32 APIs directly (GetDC/BitBlt for screenshots, VirtualAlloc+PEB-walking for manual DLL resolution, GetConsoleWindow+ShowWindow(SW_HIDE) for console-hiding), and resolves its command-and-control address through an EtherHiding technique — reading a URL/IP value out of a Polygon (Polygon Mainnet) smart contract rather than a hardcoded domain, allowing the operator to rotate infrastructure without shipping new binaries. Two publicly documented contracts are in use: a V1 contract (getDomain(), deployed 2025-02-21, later destroyed and replaced) and a V2 contract (getData(), deployed 2025-11-15).
After C2 resolution, the loader pulls two hex-encoded, XOR-encrypted 'dead drop' blobs from attacker-controlled GitHub repositories: a smaller (~594KB) updated Lua payload and a larger (~2.3MB) PE crypter stub. Both are decrypted with a shared 32-byte XOR key assembled at runtime from the obfuscated lookup table. The PE crypter is an x64 GUI binary whose RCDATA resource holds ~1MB of base64url-encoded, AES-256-ECB-encrypted content; at RVA 0x1000 it XORs two hardcoded 32-byte constants via AVX2 instructions to derive the AES key at runtime, then injects the final payload — the StealC information stealer — into a fresh process via classic process hollowing (CreateProcessA in a suspended state, NtUnmapViewOfSection, VirtualAllocEx, WriteProcessMemory, SetThreadContext, ResumeThread).
StealC is a widely available Malware-as-a-Service (MaaS) infostealer, in circulation since late 2022/early 2023 and advertised around $200/month on cybercrime forums, now at version 2.x with a JSON-based C2 protocol and a redesigned web panel. In the FakeGit chain it is configured to harvest Chrome/Brave/Edge browser data (Login Data, Cookies, Web Data, History, IndexedDB) including a bypass for Chromium App-Bound Encryption via the o
Weaknesses (CWE)
CWE-506, CWE-829, CWE-311, CWE-494
Target sectors: technology, softwaredevelopment, gaming, cryptocurrencyfinance, enterpriseit, generalconsumer
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 31 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1589.002, T1586.001, T1583.005, T1587.001, T1566.002, T1195.002, T1204.002, T1059.007, T1106, T1053.005