Executive Summary
The FakeGit campaign, attributed to the threat actor Water Kurita, has demonstrated a significant evolution in software supply chain attacks by poisoning the AI capability ecosystem. Since March 2026, researchers have identified nearly 7,600 malicious GitHub repositories, with over 800 specifically targeting AI-related workflows such as Model Context Protocol (MCP) servers and AI Skills. The campaign has recorded over 14 million downloads by masquerading as integrations for enterprise tools like Gmail, Docker, and Databricks.
Technically, the operation utilizes a novel 'AgentBaiting' method where malicious README files are optimized for discovery and parsing by AI agents like Claude Code, Gemini, and ChatGPT. When an AI agent recommends these repositories, users are directed to download ZIP archives containing a LuaJIT-based loader chain. This chain executes SmartLoader, which establishes persistence and deploys the StealC information stealer to exfiltrate browser sessions, credentials, and crypto wallets. This shift represents a move from social engineering human users to deceiving the autonomous agents acting on their behalf, significantly expanding the enterprise attack surface.