The scheme, in plain English

Security researchers uncovered a massive GitHub trick — roughly 7,600 repositories created to look helpful but actually designed to drop malware. About 800 of those mimicked AI “skills” or MCP servers to lure both humans and automated agents into downloading a payload chain that eventually runs the SmartLoader loader and pulls down a secondary thief known as StealC.

The attack was dressed up like normal developer work: cloned projects, copied profiles, plausible READMEs and a ZIP file waiting in the wings. The ZIP kicks off a LuaJIT loader that executes an obfuscated Lua script, which installs the loader and then fetches the info-stealing payload. All very neat and friendly — until it isn’t.

Even weirder: this campaign evolved a new twist called AgentBaiting. Instead of needing a human to click or paste a link, an AI assistant searching for a skill or server can stumble across these bogus repos, read the README as if it were legit instructions, and follow the attacker’s steps—automating the compromise without any human misstep.

Some numbers to make the scale sink in: the operation involved around 6,600 fake profiles, about 200 repositories contributed most of the downloads, and researchers observed over 14 million downloads from GitHub Release assets tied to the campaign. The fakes posed as integrations and tooling for everything from consumer apps to enterprise services, so the bait looked familiar and safe.

Why this matters and how to stop it

This is a classic social-engineering-plus-automation problem. The attackers didn’t break in; they built something that looks trustworthy and sat back while discovery did the work. With AI agents doing discovery on behalf of users, that passive trick now works against automated systems too.

Key risks include automated agents executing attacker-written instructions, reuse of trusted project names and workflows to gain credibility, and archive-based loaders (yes, those malicious ZIPs) that hide the real code path until it’s too late.

Practical defenses (because yelling into the void is not a strategy):

  • Maintain a vetted catalog of approved Skills, MCP servers, and agent plugins—don’t let discovery alone decide trust.
  • Test new agent capabilities and integrations in an isolated sandbox before rolling them out to production or letting agents use them automatically.
  • Verify publisher identities and confirm projects aren’t cloned impostors—check commit history and contributor provenance.
  • Monitor agentic workflows and search paths to see what bots are finding and executing, and add controls to block automatic downloads or execution from unapproved sources.
  • Flag and remove suspicious listings from public registries where possible and educate teams to treat public skills with skepticism.

In short: this campaign is a reminder that discovery equals a new attack surface. If you rely on AI assistants or let agents fetch and run code, treat that pathway like any other risky remote execution vector—sandbox it, vet it, and don’t trust anything just because it looks familiar.