Fake AI Tools on GitHub Are Hiding Malware, Researchers Find 7,600 Booby-Trapped Repos
A campaign called FakeGit is dressing up malicious code as AI helpers and developer tools to trick programmers into installing SmartLoader.
Key points
- Researchers uncovered close to 7,600 malicious GitHub repositories tied to a campaign called FakeGit, with more than 800 posing as artificial intelligence tools.
- The fake projects deliver a malware loader called SmartLoader, which quietly installs further malicious software once run.
- Attackers copy real projects, mimic trusted developer profiles, and write convincing README files to fool programmers.
- Victims download a ZIP archive that runs the malware the moment they try to use the supposed AI tool.
Security researchers have found roughly 7,600 booby-trapped projects on GitHub, the code-sharing site used by nearly every software developer in the world. The campaign has been named FakeGit.
More than 800 of those projects pretend to be artificial intelligence add-ons, according to the report first published by The Hacker News. Some pose as Model Context Protocol servers, a new type of connector that lets AI assistants like Claude or ChatGPT plug into other software. AI tools are what developers are downloading most right now, which makes the bait well chosen.
What actually happens when someone downloads one?
The victim gets a piece of malware called SmartLoader, a loader, meaning its only job is to land on a computer and pull down whatever other malicious software the criminals want next. Think of it as the delivery van, not the parcel.
Once SmartLoader is running, operators can drop password stealers or remote-control tools onto the machine. The developer usually has no idea. They were expecting an AI helper; they got a back door.
How are the fakes so convincing?
The crew behind FakeGit puts real effort into looking legitimate. They copy genuine open-source projects wholesale, slipping malicious code quietly into a corner of the package. Lookalike developer profiles sometimes clone the names and avatars of real, respected coders. README files, the front-page description a developer reads before downloading, are written in professional English and explain exactly what the tool supposedly does.
The malicious payload sits inside a ZIP archive. When the developer unpacks it and runs the setup, SmartLoader executes.
Who is at risk?
Directly, the target is software developers, especially anyone hunting for shortcuts to bolt AI features onto their own products. The risk doesn't stop there.
If a developer's laptop gets infected, the criminals can steal login tokens for company systems along with source code and cloud keys. One poisoned download can turn into a full corporate breach. That's how supply-chain attacks work: one small crack, one big flood. We've covered 27 supply-chain attack stories in the last 90 days, and this campaign follows the same playbook we reported on 10 July when Muck and Load built 222 phoney repositories to push password stealers at developers.
Ordinary people aren't being asked to click anything here. But the software you use at work, or the app on your phone, might be built by a developer who did.
Should you worry?
If you write code, yes. Treat unfamiliar GitHub repositories the way you'd treat an email attachment from a stranger. Check the account's history. A profile created last month with one shiny project is a red flag.
Look at the commit history and whether real people are discussing the code elsewhere. Run anything new in a throwaway virtual machine before letting it near your main system.
GitHub is taking down FakeGit repositories as they're reported, but the operators keep spinning up fresh ones. Close to 7,600 so far suggests an industrial operation, not a hobbyist. Expect more of it. The scale here is what matters most: 7,600 repositories dwarfs the 222 Muck and Load used in July, and that campaign alone caused real damage. Anyone who treats GitHub as an inherently trustworthy source is running a risk they may not have priced in yet.
