AI agents are becoming a new malware distribution channel

By Farukh Rakhimov, Head of Compliance, Data Protection and Information Security at AdTech Holding

Approximately 7,600 fake GitHub repositories, 6,600 fraudulent profiles and more than 14 million downloads: that’s the scale of FakeGit, a malware campaign documented by Island in July 2026. More than 800 repositories posed as AI skills and MCP servers, distributing SmartLoader and the StealC information theft.

Fake repositories are nothing new. The surprise was who recommended them.

Gemini and ChatGPT independently suggested the same malicious Walmart-mcp repository. Agents found the attacker’s project and provided users with installation instructions.

Attackers no longer need to trick users directly. They can fool assistants that users trust.

Why agents are vulnerable

Two architectural features make these attacks possible.

First, agents process instructions and external information as text. A malicious instruction hidden in a README file, web page, or tool description can be interpreted as something to be obeyed rather than analyzed. This is an indirect rapid injection.

Second, agents can act on those instructions.

Security researcher Simon Willison calls the combination of three conditions the deadly trifecta: access to valuable information, exposure to untrusted external content, and the ability to send data outside the system.

Together, these conditions turn malicious text into a potential data breach.

Other attacks exploit something simpler: fabricated trust signals. Stars, downloads, contributor histories, and registration lists can make malware appear legitimate.

Here are eight ways these weaknesses are exploited.

1. AgentBaiting: When an agent recommends malware

AgentBaiting targets the assistant and not the user.

In the FakeGit campaign, attackers created convincing repositories with realistic documentation and distributed them through public registries.

Gemini and ChatGPT independently recommended the same fake MCP connector from Walmart because it seemed relevant and credible.

The repositories distributed SmartLoader, which downloaded StealC to steal browser credentials, cookies, active sessions, and cryptocurrency wallet data.

The agents were not compromised. They simply recommended software whose apparent credibility had been fabricated.

2. Tool poisoning: instructions hidden in tool descriptions

MCP servers provide agents with textual descriptions of the available tools. Attackers can hide instructions within those descriptions.

In April 2025, Invariant Labs demonstrated how instructions embedded in a malicious calculator tool could manipulate a standalone, trusted email connector to copy outgoing messages to an attacker.

The user never sees the malicious instructions.

Tool poisoning remains a demonstrated and not publicly confirmed threat model.

real world incident.

3. When agents hide their actions

Some malicious abilities explicitly instruct agents not to reveal what they have done.

A 2026 academic study examined 98,380 skills from two registries and confirmed that 157 were malicious, identifying 632 vulnerabilities and 13 attack techniques.

A recurring instruction gave the title to the investigation: “Do not mention this to the user.”

Therefore, an agent could report that a task was completed by omitting unauthorized actions, including transmitting sensitive information.

4. Rug Pull – Trusted Software Changes After Installation

A package can behave legitimately for months before introducing malicious functions.

In September 2025, Koi Security discovered postmark-mcp, a connector that impersonates the legitimate Postmark email service.

Versions up to 1.0.15 seemed harmless. Version 1.0.16 introduced a hidden BCC recipient that copied outgoing emails to a domain controlled by the attacker.

The package potentially exposed password reset messages and authentication links associated with approximately 300 organizations.

Postmark confirmed that the connector was not its product and that its own service had not been compromised.

The attack took advantage of the trust built up by previous versions. Automatic updates allowed malicious features to arrive without renewed user approval.

5. Malicious changes can occur outside the package

Source code review cannot detect everything when external dependencies change independently.

In August 2025, Check Point disclosed MCPoison, a vulnerability in Cursor that allowed attackers to modify previously approved project configurations and execute commands without renewed approval.

Cursor 1.3 fixed the issue.

Another experiment from 2026 demonstrated how a skill distributed to approximately 26,000 agents could initially link to legitimate documentation before the external page changed to malicious installation instructions.

The package itself remained unchanged, allowing the threat to escape scanners that examined only the submitted files.

6. Opening an untrusted repository can execute code

AI-enabled development environments introduce risks even before users deliberately install additional software.

Check Point discovered that Claude Code was able to execute configuration commands controlled by the repository before users completed their trust confirmation process.

The vulnerabilities included execution of arbitrary commands (CVE-2025-59536) and exposure of API credentials via a crafted server endpoint (CVE-2026-21852).

Anthropic subsequently patched the reported vulnerabilities.

The implication is simple: opening an unknown project within an agent-enabled development environment can create execution paths that normal file inspection would not create.

7. ClickFix – Users Install Malware Themselves

ClickFix does not require any sophisticated quick injection.

Attackers disguise malicious commands as installation prerequisites within README or SKILL.md files. Users follow the instructions and execute the commands themselves.

During the ClawHavoc campaign in early 2026, researchers discovered malicious skills disguised as cryptocurrency and productivity tools in the OpenClaw ecosystem.

Koi Security identified 341 malicious skills out of 2,857 available during its audit.

Antiy CERT subsequently tracked 1,184 malicious skills associated with just 12 accounts.

The malware targeted cryptocurrency wallets, browser credentials, API keys, SSH keys, and Telegram sessions.

8. When the agent becomes an attacker

Agents can also coordinate offensive operations.

In November 2025, Anthropic reported on GTG-1002, a cyberespionage campaign in which attackers connected penetration testing tools to Claude Code via MCP.

According to Anthropic, the model independently performed approximately 80% to 90% of tactical operations, while human operators set objectives and made important strategic decisions.

Anthropic attributed the campaign to a state-sponsored group. That assessment has not been independently confirmed in public threat intelligence repositories.

The case illustrates how existing offensive tools can be integrated into autonomous workflows.

The false reputation economy

Many attacks rely on artificially manufactured credibility.

An investigation from April 2026 found that GitHub stars were advertised for between $0.03 and $0.10 each. The researchers also identified approximately six million suspicious stars in 15,835 deposits.

In another case, attackers cloned an Oura MCP connector and spent three months creating fake contribution histories before distributing the malicious version through legitimate registries.

A separate malicious Solidity extension showed artificially inflated download counts, eventually approaching two million. One blockchain developer reportedly lost approximately $500,000.

Popularity determines discoverability, not security.

Code reviews and scanners also have limitations: malicious functionality can be hidden in dependencies, tool descriptions, later updates, or external web pages.

What this means for ad tech

The open source ecosystem has faced similar supply chain threats before. Mandatory two-factor authentication, trusted publishing, and verified package provenance eventually strengthened established records.

AI skills markets are developing much faster, while their security infrastructure remains comparatively immature.

The consequences are also broader: an AI skill can operate with access to email, repositories, databases, and credentials.

For AdTech, the same risk extends directly to advertising accounts.

Media buyers and AdOps teams are increasingly connecting agents, reporting assistants, and campaign tools with DSPs, advertising platforms, and advertiser data.

A poisoned reporting or creative generation skill could expose campaign information, compromise account credentials, or put advertising budgets at risk.

The underlying deception is familiar: buying fake stars and downloads to make malware look trustworthy follows the same logic as using fake engagement and bot traffic to make fraudulent ad inventory look legitimate.

As AI agents gain more authority, verifying the software and signals they rely on becomes as important as protecting the systems they operate.