Malicious AI Skill / MCP Server Package Structure (AgentBaiting / FakeGit)
A malware campaign called AgentBaiting (also called FakeGit) publishes thousands of fake GitHub repositories disguised as AI Skills or MCP servers for popular tools like Gmail, WhatsApp, Databricks, Jenkins and Docker. When a coding agent or a user searches for one of these integrations, it can surface the attacker's repository and read the attacker's README aloud as if it were legitimate setup instructions, leading the user to install an infostealer.
How the attack works
An attacker publishes a GitHub repository styled as a Skill or MCP server and lists it on registries such as LobeHub, Glama, MCP.so or MCP Market. The README walks the reader through downloading a release archive and clicking past Windows SmartScreen and antivirus warnings. Inside the archive, a small .cmd/.bat launcher runs a renamed LuaJIT interpreter against an obfuscated Lua file disguised as a text, icon, license, or data file. That Lua program loads a piece of malware called SmartLoader, which then installs the StealC infostealer, sets up scheduled-task persistence under %LOCALAPPDATA%, and fetches its command-and-control address from a Polygon blockchain smart contract. The novel part is that AI coding agents (Claude Code, Google Gemini, ChatGPT were all shown to do this) can autonomously find these repositories and relay the attacker's instructions to the user as if they were trustworthy setup steps.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- b94eed45-b7ff-45a9-8905-462900b86bc9
- Severity
- Critical
Why it matters
A user or an AI agent acting on a user's behalf can be led to run attacker code that steals passwords, tokens and other credentials and gives the attacker a persistent foothold on the machine, all under the guise of installing a routine tool integration.
What you can do
- →Do not let coding agents auto-install Skills or MCP servers from search results without a human reviewing the source repository and its download links.
- →Treat any Skill/MCP install path that requires a bundled .cmd/.bat launcher, a downloaded .exe/.zip from GitHub Releases, or clicking through SmartScreen/antivirus warnings as suspicious rather than normal setup friction.
- →Check MCP client configuration files for server entries that point at a bundled Windows launcher instead of a standard package-manager command (npx, uvx, pip, etc.).
- →Cross-check any Skill/MCP repository against the published AgentBaiting/FakeGit indicators (repository names, file hashes, archive contents) before installing.
Known benign look-alikes
- Threat-intelligence write-ups, IOC feeds, YARA/Sigma rule sets and incident reports that quote the published FakeGit hashes, repository slugs or archive names verbatim will match Layer 6 by design.
- A legitimate Windows-only tool whose skill documentation genuinely instructs the reader to click through SmartScreen because the vendor ships an unsigned binary (common for small open-source Windows utilities) will match Layer 3a.
- A skill about Lua/LuaJIT development or game modding that lists luajit.exe or lua51.dll next to a .bat build script or a release .zip will match Layer 2.
- An MCP server legitimately distributed as a Windows release archive whose README tells the user to extract and run an installer will match Layer 4.
- Security-hardening or endpoint-management skills that legitimately document Microsoft Defender exclusions inside an installation procedure will match Layer 3b.
- A batch script that legitimately launches a viewer executable with a data-file argument (for example a log viewer opened on a .log file) will match Layer 1.