Apiiro documented a live fleet of 17,610 GitHub lure repositories that copied credible project names, reused legitimate source files and repeatedly moved README download links to malicious ZIP archives. Its October 6 snapshot identifies at least 219 accounts with independently corroborated prior developer history, amid thousands of throwaway accounts. These…
Inspect the ClaimsCase · DiggingBeagle record
FakeGit malware lures were placed alongside AI skill definitions
Apiiro linked the wider FakeGit lure fleet to 167 skill folders holding malicious ZIPs beside benign-looking SKILL.md files. Skill installers could copy those archives onto developer machines, but the malware still required a separate execution step. Repository counts are not confirmed infection counts.
Scope
Controlled finding or reported disclosure as of 2026-10-06; No proof ZIPs execute automatically when skills are installed.
Assessment profile
Assessment method- Setting
- production
- Exploitation
- observed live
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
Desk review of scoped canonical Claims, the pinned SRC-2026-CP3-FAKEGIT-AI-SKILLS Source, and the publicly accessible primary disclosure. The classification applies to the documented setting and prerequisites only. Impact remains unbanded because real victim consequences are not established, and no independent reproduction is claimed. Details: How often skill installers preserved the ZIP in actual installations is unmeasured.
Assessed Oct 13, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP3-FAKEGIT-AI-SKILLS-1 · CLM-CP3-FAKEGIT-AI-SKILLS-2 · CLM-CP3-FAKEGIT-AI-SKILLS-3 · FakeGit malicious ZIP enters AI skill directories beside SKILL.md
At a glance
Review the entire installed skill directory, including binaries and archives, rather than treating clean SKILL.md text as proof that the copied artifacts are safe. The operational boundary is execution permission, not mere download.
Read the implicationsHow often skill installers preserved the ZIP in actual installations is unmeasured. No corroborated count links the 167 skill-folder lures to automatic execution or endpoint infection. Fleet repository and account totals are a dated research snapshot, not unique victim totals.
Limits and uncertaintyFull account
Apiiro documented a live fleet of 17,610 GitHub lure repositories that copied credible project names, reused legitimate source files and repeatedly moved README download links to malicious ZIP archives. Its October 6 snapshot identifies at least 219 accounts with independently corroborated prior developer history, amid thousands of throwaway accounts. These counts establish distribution infrastructure and repository manipulation, not the number of users infected.
The AI-specific entry point is narrower: 1,169 lures appeared in AI skill directory listings, and 167 included the malicious ZIP in a folder also containing an apparently benign SKILL.md. In 96 of those 167, the skill was listed in a directory. An installer that copies the entire skill directory can carry the ZIP onto a developer's machine, but copying an archive does not execute it. The documented active malware path still requires someone or something to open the ZIP and run its launcher, leading through SmartLoader to the StealC infostealer in separately analyzed samples. This is an artifact-trust and installation-boundary problem, not evidence of automatic agent execution.
Mechanism and trust boundary
- 01
Identity confusion
A lure reuses a credible open-source or AI skill repository name and may include copied legitimate project files.
Boundary: A lure reuses a credible open-source or AI skill repository name and may include copied legitimate project files.
- 02
Artifact admission
The README points to a malicious ZIP, or a skill installer copies the ZIP alongside SKILL.md without inspecting every artifact.
Boundary: The README points to a malicious ZIP, or a skill installer copies the ZIP alongside SKILL.md without inspecting every artifact.
- 03
Execution prerequisite
A user or automated process must separately open the ZIP and execute the launcher before the malware chain runs.
Boundary: A user or automated process must separately open the ZIP and execute the launcher before the malware chain runs.
Timeline
- Oct 6, 2026disclosure
Public disclosure
Claims & evidence
CLM-CP3-FAKEGIT-AI-SKILLS-1Apiiro reports 17,610 live lure repositories and says 167 AI skill folders contained the campaign kit.supported
Basis: reported finding
- supportsFakeGit malicious ZIP enters AI skill directories beside SKILL.mdprimary disclosure
Opening metrics table and What is new here, AI skill folders
CLM-CP3-FAKEGIT-AI-SKILLS-2The investigation identifies hundreds of apparently legitimate developer accounts among campaign-controlled repositories, but reports no verified count of automatic AI skill executions or resulting endpoint infections.supported
Basis: reported finding
- supportsFakeGit malicious ZIP enters AI skill directories beside SKILL.mdprimary disclosure
What is new here, developer-account takeover and prior work
CLM-CP3-FAKEGIT-AI-SKILLS-3Apiiro found 1,169 AI-directory-listed lures and 167 malicious ZIPs co-located with SKILL.md; 96 of those 167 were directory-listed. Copying a ZIP with a skill was not shown to execute the malware.supported
Basis: reported finding
- supportsFakeGit malicious ZIP enters AI skill directories beside SKILL.mdprimary disclosure
The AI-developer angle, paragraphs on 1,169 listings and 167 skill folders
Implications
Review the entire installed skill directory, including binaries and archives, rather than treating clean SKILL.md text as proof that the copied artifacts are safe. The operational boundary is execution permission, not mere download.
Controls and mitigations
- Inventory and hash all artifacts copied by skill installers, including files not referenced by SKILL.md.
- Prevent arbitrary downloaded executables and archive launchers from running with agent or developer credentials.
- Correlate account compromise, copied artifacts, user launches and confirmed infections as separate stages when measuring impact.
Unknowns and contradictions
- How often skill installers preserved the ZIP in actual installations is unmeasured.
- No corroborated count links the 167 skill-folder lures to automatic execution or endpoint infection.
- Fleet repository and account totals are a dated research snapshot, not unique victim totals.
Sources and citation
Material revision history
- Oct 13, 2026 · Published version · first publication · revision 137