FakeGit Uses 7,600 GitHub Repos to Spread SmartLoader Malware

Cybersecurity researchers discovered nearly 7,600 malicious GitHub repositories, more than 800 of which pose as artificial intelligence (AI) skills or Model Context Protocol (MCP) servers that deliver a malware family known as SmartLoader ¹.

The campaign is codenamed FakeGit. Its tactics include copied projects, lookalike developer profiles, convincing README files, and malicious ZIP archives that contain the payloads ¹.

SmartLoader operates by downloading additional components from the same repository before executing them on the victim’s machine. The malware can steal credentials, install backdoors, and pivot laterally within an organization once it has gained initial foothold ¹.

Experts note that this method echoes earlier operations such as UNC3456’s use of copied repositories on GitLab in late‑2018/early‑2019. They also point out that credential stuffing attacks targeting online gaming platforms across Southeast Asia between Q1/Q2 2021 likely supplied the stolen credentials used to set up these fake AI/MCP servers. This suggests attackers are exploiting organizations already employing AI infrastructure for lateral movement, while the reliance on ZIP archives bypasses many security scanners that focus primarily on executable files like DLLs or COM objects.

Because the repos appear legitimate and the ZIP archives mimic normal development artifacts, defenders may overlook them until the malware activates. The sheer volume—nearly 7,600 repositories—also makes manual review impractical, underscoring the need for automated detection based on repository metadata and build activity patterns.