AI assistants are supposed to help users find safe tools. A new malware campaign shows they can also lead users straight to dangerous ones. According to reporting by Farukh Rakhimov, Head of Compliance, Data Protection and Information Security at AdTech Holding, a campaign called FakeGit used thousands of fake GitHub repositories to spread malware — and AI agents recommended one of them to users.
What Is the FakeGit Malware Campaign?
FakeGit was documented by Island in July 2026. The scale of the operation was large:
- Roughly 7,600 fake GitHub repositories
- 6,600 fraudulent profiles
- More than 14 million downloads
Over 800 of these repositories impersonated AI skills and MCP servers. They distributed SmartLoader and the StealC infostealer. Fake repositories are nothing new on GitHub, but the surprise in this campaign was who recommended them.
How AI Agents Became a Malware Distribution Channel
Gemini and ChatGPT independently suggested the same malicious walmart-mcp repository. The agents found the attacker's project and handed users installation instructions. This means attackers no longer need to deceive users directly — they can deceive the assistants users trust.
To put it plainly, the trust users place in AI assistants is now the attack surface. A user who would never click a suspicious link might still follow step-by-step instructions from a chatbot they rely on every day.
Why AI Agents Are Vulnerable
The original story notes that two architectural weaknesses make agents vulnerable to this kind of manipulation. The agents search for and surface projects without fully verifying who built them or what the code actually does. When a fake repository is built to look like a legitimate AI skill or MCP server, the agent has no reliable way to tell the difference.
Our Take: Trust in AI Assistants Is Now a Security Risk
In our view, this is a serious shift in how malware spreads. For years, security advice has been simple: don't download from unknown sources, check the publisher, read the reviews. That advice assumed a human was making the final call. Now an AI agent is making that call for millions of users, and in this case, it got it wrong.
The deeper problem is that users have no easy way to know when their assistant is recommending something dangerous. The recommendation looks the same whether the repository is safe or malicious. That is what makes this campaign effective — not the malware itself, but the trusted voice delivering it.
Readers who use AI assistants for coding or tool discovery should treat any suggested repository with the same caution they would apply to a link from a stranger. Verify the publisher independently. Check the repository's history and activity. Do not install anything an agent recommends without a second look.
The companies behind these agents also carry responsibility. If an assistant is going to recommend software, it needs to verify that software before handing users installation instructions. Until that happens, AI agents will remain a malware distribution channel — and users will keep trusting them anyway.
Sources & References
This article is based on the original story by Farukh Rakhimov, Head of Compliance, Data Protection and Information Security at AdTech Holding, covering the FakeGit malware campaign documented by Island in July 2026.
