Fake AI Agent Repos Are Shipping SmartLoader

A GitHub repository can look like a Claude skill, a Codex helper, an MCP server, or an OpenClaw deployment and still be a Windows malware delivery vehicle. A Nov. 4 indicator list from security researcher fr0gger documents 73 such repositories. The list’s re-check found 51 still live and 22 returning 404. The payload path runs through the README, while the SKILL.md can stay clean.

The cluster is a focused slice of the larger FakeGit operation. Island documented about 7,600 malicious repositories in July 2026, including more than 800 posing as AI skills or MCP servers. Apiiro reported 17,610 repositories in October, with 97% of sampled commits touching only the README and 88% pointing a download button at a ZIP that installs SmartLoader. The Nov. 4 list shows the same pattern at the scale an individual developer or agent is likely to encounter: a plausible repository, a helpful README, and a ZIP that should never be run.

What the 73-repo cluster contains

The lures borrow the vocabulary of the agent ecosystem. The list includes repositories named codex-messenger, hermes-agent-orange-book, claude-sbox-setup, skill-manager, pcloud-mcp, openclaw-deploy-ninja, mcp-superset, and ContinuousClaudeV4.7. Some names track real projects closely. Others are generic enough to appear in search results for “free skill” or “MCP server.” The gist lists a committed ZIP for every repository, including paths such as .claude/hooks/config/supercharged-claude-skills-v2.0.zip, .claude/commands/anywhere_agents_v3.4.zip, src/mcp_superset/tools/superset_mcp_1.0.zip, and workflows_backup/.../ninja-deploy-openclaw-v2.1.zip.

That placement matters. A scanner that walks skill directories and validates manifests may never open .claude/hooks/config/ or a workflows_backup folder. A human who trusts the README may not either.

The README is the installation path

A live example from the list, codex-messenger, shows the handoff. The README is written as ordinary setup documentation. It has a “Download-Latest” badge, Windows 10/11 requirements, and a numbered install sequence. Step 3 tells the user that Windows may show a blue box titled “Windows protected your PC.” Step 4 says click “More info.” Step 5 says click “Run anyway.”

That is the SmartScreen bypass, written into the README as a troubleshooting note. The download link points to a ZIP committed to the repository, not to a release asset or a package registry. The repository had one star, no forks, and no issues at review time. Its commit history is more revealing: an initial commit on May 5, two “Harden Windows updater relaunch” commits on May 6, and a README-only update on Oct. 14. The repository aged for five months, then the lure was refreshed.

One sample, inspected without running it

A directory listing of the ZIP from that repository, without execution, shows four files:

• Application.bat, 26 bytes, containing start util64.exe lfs.txt
• lfs.txt, 310,060 bytes, beginning with return(function(...) and packed into a single obfuscated Lua line
• lua51.dll, 601,461 bytes
• util64.exe, 31,920 bytes

There is no MCP manifest, no server source, no package metadata, and no reason for a Windows launcher. The launcher starts a renamed Lua runtime and feeds it the text file. That structure matches the SmartLoader chain documented by Island and Derp.ca: a small .cmd or .bat launcher, a LuaJIT-style runtime, and an obfuscated Lua payload disguised as a text or data file. SmartLoader resolves command infrastructure, establishes persistence through scheduled tasks, and pulls encrypted stages that lead to StealC.

The ZIP’s SHA-256 is 53039bdeb3e155236dce324281f59846c2da7518a54859c409286aaff86d61a2, which matches the gist. The sample matches the same packaging pattern across the list.

Why agents make this worse

The README is not just for humans. Island’s AgentBaiting tests found that Claude Code, Gemini, and ChatGPT could surface campaign repositories when asked for a capability, without being given a link. In one Claude Code run, the agent recommended the malicious repository’s instructions, including the “Run anyway” step. In another, it cloned the repository and downloaded the files before stopping. The agent treated the README as documentation because that is what READMEs are for.

This is the part that a skill-only scanner misses. The manifest can be clean. The SKILL.md can be clean. The settings file can be clean. The README can still tell the user or the agent to download and run a Windows executable. The attack surface is the whole repository, including the text that explains how to install it.

The ZIP is not a skill

For a skill or MCP server, the default should be source code plus a manifest and a documented way to run it. A ZIP that contains a batch file, a renamed Lua runtime, and a 310 KB text file is a loader. The distinction gives reviewers a hard stop: if an agent capability ships a Windows executable or a launcher script, reject it before looking at the feature list. A binary can be legitimate, but it needs a verified vendor, a signature, and a hash that matches a published release. A ZIP committed to an unknown repository has none of those.

What to check before installing

• Read the README as untrusted input. Look for download buttons, ZIP links, “Run anyway,” “disable SmartScreen,” or instructions to paste a command.
• Check the owner and history. New accounts, lookalike names, one-character-off maintainers, low stars, and a long-lived repository with a recent README-only commit are campaign signals.
• Inspect the ZIP. List the contents without running them. Reject .bat, .cmd, .exe, .dll, and obfuscated .txt files in a skill package.
• Do not run a ZIP committed to a repository. Prefer official registries, vendor repositories, signed releases, and pinned commits. Verify the hash.
• Do not let an agent auto-install. Require human approval for downloads, package installs, and any command that executes a binary from a repository.
• Use an isolated environment. No browser sessions, cloud tokens, SSH keys, or production data. A Windows loader cannot run on Linux, but a Linux-native payload could. Isolation is containment, not detection.

If a ZIP was executed

Treat the host as compromised. Isolate it, revoke active browser sessions, OAuth grants, API tokens, cloud credentials, and developer tokens. StealC takes live sessions, so password resets alone are not enough. Check %LOCALAPPDATA% for scheduled tasks and review outbound connections. If the repository looks like a hijacked legitimate account, rotate that account’s sessions and enable passkeys.

Indicators from the gist

The full list is in the gist. These hashes are not a complete blocklist, and the operators can re-point a repository at a new ZIP. The repository names, owner patterns, and README instructions are as important as the file hashes.

Bottom line

The 73-repository list is significant because it is current, specific, and aimed at the way agents discover tools. 51 live repositories in a Nov. 4 snapshot is not a historical artifact. The defense is a rule that the README, the ZIP, the commit history, and the owner are all part of the package, and that no ZIP from a repository runs without review.

Related Reading

• The 10,000-repo GitHub malware campaign and the SmartLoader chain

Sources and References

• fr0gger, GitHub ZIP lure IOCs, Nov. 4, 2026
• BleepingComputer, FakeGit returns with 17,610 malicious repositories, Oct. 8, 2026
• Island, AgentBaiting: How 800+ fake AI skills and MCP servers delivered malware, July 20, 2026
• Apiiro, Never deleted, only re-pointed, October 2026
• Derp.ca, FakeGit LuaJIT GitHub campaign