Fake AI Tools on GitHub Are Hiding Malware, Researchers Find 7,600 Booby-Trapped Repos

Key points

• Researchers uncovered close to 7,600 malicious GitHub repositories tied to a campaign called FakeGit, with more than 800 posing as artificial intelligence tools.
• The fake projects deliver a malware loader called SmartLoader, which quietly installs further malicious software once run.
• The attackers copy real projects, mimic trusted developer profiles, and write convincing README files to fool programmers.
• Victims download a ZIP archive that runs the malware the moment they try to use the supposed AI tool.

Security researchers have found roughly 7,600 booby-trapped projects on GitHub, the code-sharing site used by nearly every software developer in the world. The campaign has been named FakeGit.

More than 800 of those projects pretend to be artificial intelligence add-ons, according to the report first published by The Hacker News. Some pose as Model Context Protocol servers, a new type of connector that lets AI assistants like Claude or ChatGPT plug into other software.

The bait is well chosen. AI tools are the hottest thing developers are downloading right now.

What actually happens when someone downloads one?

The victim gets a piece of malware called SmartLoader. SmartLoader is what the industry calls a loader, meaning its only job is to sneak onto a computer and then pull down whatever other malicious software the criminals want to install next. Think of it as the delivery van, not the parcel.

Once SmartLoader is running, the operators can drop password stealers, remote-control tools, or crypto-wallet drainers onto the machine. The developer usually has no idea anything happened. They were expecting an AI helper. They got a back door.

How are the fakes so convincing?

The crew behind FakeGit puts real effort into looking legitimate. They copy genuine open-source projects wholesale, then quietly slip malicious code into a corner of the package.

They build lookalike developer profiles, sometimes cloning the names and avatars of real, respected coders. The README files, which are the front-page description a developer reads before downloading, are written in fluent, professional English and explain exactly what the tool supposedly does.

The malicious payload is bundled inside a ZIP archive, the same file format anyone uses to bundle documents. When the developer unpacks it and runs the setup, SmartLoader executes.

Who is at risk?

Directly, the target is software developers, especially anyone hunting for shortcuts to bolt AI features onto their own products. Indirectly, the risk spreads.

If a developer's laptop gets infected, the criminals can steal login tokens for company systems, source code, cloud keys, and customer data. From there, one poisoned download can turn into a full corporate breach. That is how supply-chain attacks work: one small crack, one big flood.

Ordinary people are not being asked to click anything here. But the software you use at work, or the app on your phone, might be built by a developer who did.

What should developers do right now?

Treat unfamiliar GitHub repositories the way you would treat an email attachment from a stranger. Check the account's history. A profile created last month with one shiny project is a red flag.

Look at the star count, the issue history, and whether real people are talking about the code elsewhere. Run anything new in a throwaway virtual machine before letting it near your main computer.

GitHub is taking down FakeGit repositories as they are reported, but the operators keep spinning up fresh ones. The volume, close to 7,600 so far, suggests this is an industrial operation, not a hobbyist.

Expect more of it as the AI gold rush continues.