AI Agents Become a New Malware Distribution Channel
An AdTech Holding expert detailed the FakeGit campaign: roughly 7,600 fake GitHub repositories, 6,600 fraudulent profiles and over 14 million downloads. More than 800 repositories impersonated AI skills and MCP servers to spread SmartLoader and StealC, with Gemini and ChatGPT themselves recommending the malicious walmart-mcp.
- FakeGit: 7,600 repositories, 6,600 profiles and over 14 million downloads
- 800+ repositories impersonated AI skills and MCP servers
- Gemini and ChatGPT both recommended the same malicious walmart-mcp
- AgentBaiting deceives the assistant rather than the user
Read next
Security