GoKawiilA large-scale operation dubbed ‘FakeGit’ is pushing SmartLoader and StealC malware through 7,600 malicious GitHub repositories that accumulated more than 14 million downloads.
Over 800 repositories pretended to be AI skills or MCP servers and appeared more than 600 times in public AI registries and catalogs. This increased the likelihood of being discovered by AI agents and developers, a technique that researchers call "agentbaiting."
The campaign is considered a continuation of an older operation that used Lumma Stealer and was attributed to a threat actor tracked as “Water Kurita” by researchers at cybersecurity company Trend Micro.
According to researchers at the enterprise browser platform Island, the AI focus was introduced in March and peaked in April, with the creation of 300 GitHub repositories linked to AI tools.
Researchers found that FakeGit grew to more than 1,400 repositories related to AI tools, agents, and workflows, all linking to SmartLoader or StealC malware downloads.
Malicious GitHub repository
Source: Island
Many of the repositories imitate consumer and enterprise tools such as Gmail, WhatsApp, Databricks, Jenkins, and Docker, and include convincing documentation, fabricated stars and fork counts, copied project descriptions, and real developer account names.
Their README files direct visitors to download ZIP archives that pose as installers or project releases but are disguised Lua payloads that trigger SmartLoader.
Once SmartLoader is active, it establishes persistence through scheduled tasks, retrieves its command-and-control (C2) address through a Polygon smart contract, and downloads additional encrypted stages from GitHub, ultimately delivering the StealC information stealer.
... continue reading