AI Agents Are Becoming a New Malware Distribution Channel

By Farukh Rakhimov, Head of Compliance, Data Protection and Information Security at AdTech Holding

Roughly 7,600 fake GitHub repositories, 6,600 fraudulent profiles and more than 14 million downloads: that is the scale of FakeGit, a malware campaign documented by Island in July 2026. Over 800 repositories impersonated AI skills and MCP servers, distributing SmartLoader and the StealC infostealer.

Fake repositories are nothing new. The surprise was who recommended them.

Gemini and ChatGPT independently suggested the same malicious walmart-mcp repository. The agents found the attacker’s project and handed users installation instructions.

Attackers no longer need to deceive users directly. They can deceive the assistants users trust.

Why Agents Are Vulnerable

Two architectural characteristics make these attacks possible.

First, agents process instructions and external information as text. A malicious instruction hidden in a README, webpage or tool description may be interpreted as something to obey rather than analyze. This is indirect prompt injection.

Second, agents can act on those instructions.

Security researcher Simon Willison calls the combination of three conditions the lethal trifecta: access to valuable information, exposure to untrusted external content and the ability to send data outside the system.

Together, these conditions turn malicious text into a potential data breach.

Other attacks exploit something simpler: fabricated trust signals. Stars, downloads, contributor histories and registry listings can make malicious software appear legitimate.

Here are eight ways these weaknesses are being exploited.

1. AgentBaiting: When an Agent Recommends Malware

AgentBaiting targets the assistant rather than the user.

In the FakeGit campaign, attackers created convincing repositories with realistic documentation and distributed them through public registries.

Gemini and ChatGPT independently recommended the same fake Walmart MCP connector because it appeared relevant and credible.

The repositories distributed SmartLoader, which downloaded StealC to steal browser credentials, cookies, active sessions and cryptocurrency wallet data.

The agents were not compromised. They simply recommended software whose apparent credibility had been manufactured.

2. Tool Poisoning: Instructions Hidden in Tool Descriptions

MCP servers provide agents with textual descriptions of available tools. Attackers can hide instructions inside those descriptions.

In April 2025, Invariant Labs demonstrated how instructions embedded in a malicious calculator tool could manipulate a separate, trusted email connector into copying outgoing messages to an attacker.

The user never sees the malicious instructions.

Tool poisoning remains a demonstrated threat model rather than a publicly confirmed 

real-world incident.

3. When Agents Conceal Their Actions

Some malicious skills explicitly instruct agents not to disclose what they have done.

A 2026 academic study examined 98,380 skills from two registries and confirmed 157 as malicious, identifying 632 vulnerabilities and 13 attack techniques.

One recurring instruction gave the research its title: “Do Not Mention This to the User.”

An agent could therefore report that a task was completed while omitting unauthorized actions, including the transmission of sensitive information.

4. Rug Pull: Trusted Software Changes After Installation

A package may behave legitimately for months before introducing malicious functionality.

In September 2025, Koi Security uncovered postmark-mcp, a connector impersonating the legitimate Postmark email service.

Versions through 1.0.15 appeared harmless. Version 1.0.16 introduced a hidden BCC recipient that copied outgoing emails to an attacker-controlled domain.

The package potentially exposed password-reset messages and authentication links associated with approximately 300 organizations.

Postmark confirmed that the connector was not its product and that its own service had not been compromised.

The attack exploited trust accumulated by earlier versions. Automatic updates allowed malicious functionality to arrive without renewed user approval.

5. Malicious Changes Can Happen Outside the Package

Reviewing source code cannot detect everything when external dependencies change independently.

In August 2025, Check Point disclosed MCPoison, a vulnerability in Cursor that allowed attackers to modify previously approved project configurations and execute commands without renewed approval.

Cursor 1.3 addressed the issue.

Another 2026 experiment demonstrated how a skill distributed to approximately 26,000 agents could initially link to legitimate documentation before the external page changed to malicious installation instructions.

The package itself remained unchanged, allowing the threat to escape scanners examining only submitted files.

6. Opening an Untrusted Repository Can Execute Code

AI-enabled development environments introduce risks even before users deliberately install additional software.

Check Point found that Claude Code could execute repository-controlled configuration commands before users completed its trust-confirmation process.

The vulnerabilities included arbitrary command execution (CVE-2025-59536) and API credential exposure through a manipulated server endpoint (CVE-2026-21852).

Anthropic subsequently patched the reported vulnerabilities.

The implication is straightforward: opening an unfamiliar project inside an agent-enabled development environment may create execution paths that ordinary file inspection would not.

7. ClickFix: Users Install Malware Themselves

ClickFix requires no sophisticated prompt injection.

Attackers disguise malicious commands as installation prerequisites inside README or SKILL.md files. Users follow the instructions and execute the commands themselves.

During the ClawHavoc campaign in early 2026, researchers discovered malicious skills masquerading as cryptocurrency and productivity tools in the OpenClaw ecosystem.

Koi Security identified 341 malicious skills among 2,857 available during its audit.

Antiy CERT subsequently tracked 1,184 malicious skills associated with just 12 accounts.

The malware targeted cryptocurrency wallets, browser credentials, API keys, SSH keys and Telegram sessions.

8. When the Agent Becomes the Attacker

Agents can also coordinate offensive operations.

In November 2025, Anthropic reported GTG-1002, a cyberespionage campaign in which attackers connected penetration-testing tools to Claude Code through MCP.

According to Anthropic, the model independently performed approximately 80–90% of tactical operations, while human operators established objectives and made major strategic decisions.

Anthropic attributed the campaign to a state-sponsored group. That assessment has not been independently confirmed in public threat-intelligence repositories.

The case illustrates how existing offensive tools can be assembled into autonomous workflows.

The Economics of Fake Reputation

Many attacks depend on artificially manufactured credibility.

An April 2026 investigation found GitHub stars advertised for $0.03–$0.10 each. Researchers also identified approximately six million suspicious stars across 15,835 repositories.

In another case, attackers cloned an Oura MCP connector and spent three months creating fake contribution histories before distributing the malicious version through legitimate registries.

A separate malicious Solidity extension displayed artificially inflated download counts, eventually approaching two million. One blockchain developer reportedly lost approximately $500,000.

Popularity determines discoverability, not security.

Code reviews and scanners also have limitations: malicious functionality can hide in dependencies, tool descriptions, subsequent updates or external webpages.

What This Means for AdTech

The open-source ecosystem has faced similar supply-chain threats before. Mandatory two-factor authentication, trusted publishing and verified package provenance eventually strengthened established registries.

AI skill marketplaces are developing much faster, while their security infrastructure remains comparatively immature.

The consequences are also broader: an AI skill may operate with access to email, repositories, databases and credentials.

For AdTech, the same risk extends directly to advertising accounts.

Media buyers and AdOps teams increasingly connect agents, reporting assistants and campaign tools to DSPs, advertising platforms and advertiser data.

A poisoned reporting or creative-generation skill could expose campaign information, compromise account credentials or put advertising budgets at risk.

The underlying deception is familiar: buying fake stars and downloads to make malicious software appear trustworthy follows the same logic as using fake engagement and bot traffic to make fraudulent advertising inventory look legitimate.

As AI agents gain more authority, verifying the software and signals they trust becomes as important as securing the systems they operate.