FakeGit

Active campaign · tracked since 1 August 2026 · reviewed 1 September 2026

By Shuky Bendek, founder of RepoGates

What this is. An active campaign in which throwaway maintainer accounts publish repositories that look ordinary and ship a trojanised release-asset ZIP. Roughly 14 million of those downloads have been observed. The payload arrives through the browser, not through git clone.

The figures, and which is which. The campaign as reported is about 7,600 repositories published from about 6,600 accounts made for it. The 14,084,688 downloads were counted on the release ZIPs of 211 of those repositories, 335 files in all. Both come from Island's AgentBaiting report of 20 July 2026, as reported by BleepingComputer and the Cloud Security Alliance on 21 July 2026.

Why the download path is the whole story

Most supply-chain tooling watches package registries and dependency manifests. FakeGit does not need either. The victim is a developer who finds a repository, believes it, and presses Download ZIP — or takes a release asset from the Releases tab. Nothing is installed, nothing is resolved, no manifest is touched. By the time the archive is extracted the code is already on the machine.

That is the path RepoGates gates. It is also the reason the gate lives in the browser: a backend cannot see the click, and a CLI scanner is never invoked.

What the checks look for

No single signal identifies this campaign; the accounts are built to survive a glance. What does not survive is the combination:

  • C1–C2 — account and repository age. The maintainer account and the repository are both young, and were created close together.
  • C3 — star pattern. Stars arrive in bursts from accounts with no other history.
  • C4 — fork and lookalike. The repository name is one edit away from something well known.
  • C5 — contributor concentration. One author, no review, no outside contribution.
  • C9 — release-asset binaries. A binary asset attached to a release whose source tree does not explain it. This is the check that speaks directly to the payload, and the one no other vendor runs.
  • C22 — AI-agent provenance. Over 800 of the campaign's repositories posed as AI Skills or MCP servers so that an assistant would recommend them — AgentBaiting. Only the browser can see that the recommendation happened.

What RepoGates does about it

Two things, and they are separate. The 22 checks assess the repository and return a verdict; a failing verdict holds the download and cancels it before the file reaches its final path. Independently, the campaign blocklist carries confirmed indicators — accounts, repositories, and asset hashes — and blocks them outright, ahead of the checks and ahead of an organisation's own allowlist. Every entry on that list carries its evidence and an expiry; entries that cannot be removed as fast as they were added are not entries we ship.

What it does not do

RepoGates does not stop git clone, gh, curl, npm install, go get, a Docker build, or an AI agent that fetches on its own. A browser extension cannot observe processes outside the browser. If a FakeGit repository is cloned rather than downloaded, this product is not in the path — and we would rather say so than imply cover we do not provide.

Add RepoGates to Chrome or Edge How the checks work