FakeGit malware campaign uses 7600 fake GitHub repos to spread via AI agents
fake malware campaign uses 7600 fake github repositories and 6600 fraudulent profiles to distribute malware through ai agents. this affects developers and users who download ai-related software.
a malware campaign called fakegit was documented by island in july 2026. the campaign used 7600 fake github repositories, 6600 fraudulent profiles, and resulted in over 14 million downloads. over 800 repositories impersonated ai skills and mcp servers, distributing smartloader malware. this campaign affects developers and users who download ai-related software, highlighting the growing threat of ai agents being used as a malware distribution channel.