By Farukh Rakhimov, Head of Compliance, Data Protection and Information Security at AdTech Holding
Roughly 7,600 fake GitHub repositories, 6,600 fraudulent profiles and more than 14 million downloads: that is the scale of FakeGit, a malware campaign documented by Island in July 2026. Over 800 repositories impersonated AI skills and MCP servers, distributing SmartLoader and the StealC infostealer.
Fake repositories are nothing new. The surprise was who recommended them.
Gemini and ChatGPT independently suggested the same malicious walmart-mcp repository. The agents found the attacker’s project and handed users installation instructions.
Attackers…
Read the full article at ARTIFICIALINTELLIGENCE-NEWS.COM
