FakeGit re-arms 17,610 malicious GitHub repos to drop SmartLoader and steal sessions
On October 8, 2026, Apiiro revealed that the FakeGit campaign has re-activated 17,610 fake GitHub repositories distributing the SmartLoader loader, several hundred of them impersonating AI skills and MCP servers. Before installing a repo from GitHub, check the account owner and prefer official registries.