AgentBaiting Campaign Uses 800 Fake AI Skills and MCP Servers to Deliver SmartLoader Malware

Key Takeaways

• A new campaign, dubbed “AgentBaiting,” is actively exploiting the growing interest in AI tools by distributing SmartLoader malware through fake AI Skills and Model Context Protocol (MCP) servers.
• Attackers are leveraging platforms like GitHub and public AI capability catalogs to host over 800 fraudulent AI-related projects, making them appear legitimate.
• The campaign is widespread, with researchers identifying approximately 7,600 malicious repositories and over 14 million downloads of malicious payloads.
• AI agents (e.g., Claude Code, Gemini, ChatGPT) can inadvertently recommend these malicious repositories, increasing the risk of compromise for users seeking AI integrations.
• The SmartLoader malware ultimately deploys StealC, a sophisticated info-stealer capable of exfiltrating sensitive credentials, browser data, and session tokens.

AgentBaiting Leverages Fake AI Tools for Malware Distribution

In an evolving threat landscape, cybercriminals are increasingly weaponizing the burgeoning field of artificial intelligence as a vector for malware delivery. A recently uncovered operation, named AgentBaiting, is actively employing deceptive AI Skills and Model Context Protocol (MCP) servers to disseminate SmartLoader malware. This sophisticated campaign exploits the trust associated with platforms like GitHub and public capability catalogs by presenting malicious projects as legitimate AI integrations, as detailed in a recent report by Island.

The AgentBaiting campaign transforms a seemingly innocuous search for AI integration tools into a high-risk scenario for unsuspecting users. Victims are directed to ZIP archives, masquerading as legitimate installers, and then prompted to execute contained files that bear no functional resemblance to the advertised AI tool. Instead, these files deploy the SmartLoader malware.

The Scale of the FakeGit Operation

Island researchers first identified this campaign while monitoring the broader FakeGit operation. Their investigation revealed an extensive network comprising approximately 7,600 malicious repositories, created by roughly 6,600 distinct profiles. Crucially, over 800 of these profiles were specifically designed to imitate AI Skills or MCP servers. This scale indicates a highly organized and persistent threat actor.

The AI-focused phase of the campaign saw a significant surge in activity from March to April 2026. Malicious projects were listed more than 600 times across various public AI registries and catalogs, amplifying their visibility and potential reach. Furthermore, researchers documented over 14 million downloads from release assets across approximately 200 repositories linked to this campaign, underscoring the significant impact of AgentBaiting.

Anatomy of the AgentBaiting Lure

The success of FakeGit, and by extension AgentBaiting, hinges on its ability to establish a convincing facade of legitimacy. This is achieved through the replication of existing projects, the creation of lookalike user accounts, the provision of seemingly credible documentation, and the manipulation of engagement metrics to suggest popularity.

One notable example involved a lure that mimicked a popular Claude Skills collection, offering a ZIP archive confirmed to contain SmartLoader instead of the advertised AI tool. This tactic mirrors previous fake GitHub malware delivery operations that exploited familiar development workflows to gain user trust.

The malicious lures are designed to appeal to both individual users and enterprise environments, spanning various functionalities such as email, messaging, analytics, build systems, cloud services, and developer tools. Their deceptive naming conventions make them appear relevant to daily operational tasks, thereby reducing suspicion. Island’s analysis showed that 62 malicious repositories were presented as suitable for enterprise or internal developer use. Additionally, nearly two-thirds of the MCP lures falsely claimed to facilitate connections to cloud services, databases, or APIs.

The infection chain typically begins with a repository like 45d5r/databricks-mcp-server. This repository, for instance, advertises an enterprise integration with accompanying documentation and a download link. However, the downloaded archive contains a command launcher, a disguised LuaJIT-style runtime, and an obfuscated Lua program posing as a simple text file. Executing the launcher initiates the hidden payload rather than installing the promised MCP server.

Further analysis revealed that related malware variants can operate stealthily by hiding their console windows, retrieving command server details from a Polygon smart contract, establishing persistence through scheduled tasks, and fetching encrypted stages from GitHub. These stages ultimately inject StealC, a potent info-stealer, into another process, continuing the credential theft objective previously observed in operations targeting StealC infrastructure.

AI Discovery Becomes Risk

A critical new dimension introduced by AgentBaiting is the potential for AI agents themselves to discover and recommend these malicious projects, even without a direct link being provided to a human user. During testing, researchers found that AI models such as Claude Code, Gemini, and ChatGPT could independently identify campaign repositories when prompted to find a specific AI Skill or MCP server.

While the results varied, they consistently highlighted a dangerous vulnerability. In one test, an AI agent recommended a benign option but also included malicious installation instructions as an alternative. Another test saw Gemini return a fraudulent Walmart MCP repository as its top result, while ChatGPT listed the same repository among public options, even highlighting it as a suggested starting point.

The risk is further exacerbated by public registries, which can amplify exposure to these malicious offerings. Island observed over 600 campaign listings across platforms like LobeHub, Glama, MCP.so, and MCP Market. Some of these registries even reproduced the attackers’ fabricated documentation and download instructions, lending an additional layer of credibility to the malicious repositories. This is particularly concerning given growing security concerns surrounding MCP servers and AI integrations that may access sensitive business resources.

What You Should Do

• Utilize Curated Catalogs: Rely on officially curated and vetted catalogs for AI Skills, MCP servers, and agent plug-ins instead of unrestricted discovery methods.
• Isolate and Test New Capabilities: Before deploying any new AI capability, thoroughly test it in an isolated environment devoid of browser sessions, cloud credentials, SSH keys, or production data.
• Scrutinize Downloaded Files: Reject any purported AI capability distributed as a Windows ZIP file that contains a launcher and a hidden payload, as this is a common indicator of compromise.
• Verify Publishers and Projects: Do not rely solely on star counts, copied profiles, or registry listings to establish legitimacy. Always verify the authenticity and reputation of publishers as rigorously as you evaluate the projects themselves.
• Monitor Agent Activity: Implement robust monitoring for downloads, Git clones, shell commands, and any changes to MCP or Skill configurations initiated by AI agents.
• Maintain a Capability Inventory: Keep a detailed inventory of each AI capability, including its source repository, commit hash, version, and package hash, to expedite incident response and investigation.
• Incident Response for Suspected Infection: If SmartLoader execution is suspected, immediately isolate the affected endpoint. Revoke all active browser sessions, OAuth grants, API tokens, cloud credentials, and developer credentials. Be aware that password resets alone may be insufficient, as StealC can exfiltrate live sessions, browser data, email, remote-access credentials, screenshots, and host details.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.