Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →FakeGit is a malware campaign that hides infostealer loaders inside GitHub repositories dressed up as ordinary software projects. In October 2026, security firm Apiiro reported 17,610 live lure repositories, and BleepingComputer reported that more than 13,000 of them were pushed again within 34 hours. A GitHub link is not a safety signal on its own. A ZIP file from an unfamiliar repository should be treated as untrusted until you have checked who published it and where it came from.
What the FakeGit campaign does
The lure usually copies or imitates a legitimate project. The operators replace or add to the project’s README with a friendly installation guide and a download badge. The button or link in that guide leads to a ZIP archive rather than to a normal package install or a release on the project’s own site. Apiiro’s analysis describes the ZIP as the start of a loader chain that runs LuaJIT code and a loader called SmartLoader. According to Apiiro, SmartLoader can install the StealC information stealer. Not every repository carries the same payload, and a visit to a lure page does not by itself mean a computer was infected.
As an Amazon Associate I earn from qualifying purchases.
What the numbers measure
The campaign has been reported with several counts from different sources. They measure different things, so they should not be added together or presented as a single population figure. None of them is a live census of GitHub.
Recommended Free Tools
| Figure | What it counts | Source and date |
|---|---|---|
| 17,610 | Live FakeGit lure repositories at the time of Apiiro’s investigation | Apiiro, October 2026 |
| 18,864 | Repositories involved when download hosts and forked copies are included | Apiiro, October 2026 |
| 79% of the fleet | Repositories re-pushed in waves on October 4–5, 2026; most sampled changes altered only the README | Apiiro, October 2026 |
| More than 13,000 | Repositories pushed in 34 hours during the same revival | BleepingComputer, October 8, 2026, summarizing Apiiro’s findings |
| 71% of the fleet | Repositories absent from Apiiro’s URLhaus snapshot taken before its report | Apiiro, October 2026 |
| Nearly 7,600 and more than 800 | Malicious repositories found by Island in July, including more than 800 posing as AI skills or MCP servers | Island, reported by The Hacker News, July 20, 2026 |
The October figures describe one investigation and its snapshot. The July figures come from an earlier, separate analysis and describe a different snapshot of the same family of lures.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How an infection typically unfolds
- The repository looks legitimate. The README resembles project documentation and includes a download badge.
- The reader follows the download link. The link resolves to a ZIP archive. Apiiro describes it as the first stage of the chain.
- The archive starts a loader chain. According to Apiiro’s analysis, the ZIP runs LuaJIT code and then SmartLoader.
- A later payload may follow. Apiiro reports that SmartLoader can install StealC, which is designed to collect saved credentials, browser data and session material.
Two points matter for risk. First, the chain only reaches the payload stage if the archive is downloaded and its contents are run. Second, the reported payloads vary across repositories, so a clean result from one lure does not clear another.
Why removing repositories has not ended the campaign
Apiiro calls the core technique “RePointing.” The operator keeps a repository online and changes where its download button points. The same operator can redirect a README to a backup copy after a takedown. Copies of the payload were also found in forks, in older ZIP files, in release assets, in issue attachments, and in separate repositories created only to host downloads.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Apiiro observed that 71% of the fleet was missing from its URLhaus snapshot before its report, and that listed files could still be downloadable. For a reader, the practical lesson is that a blocklist hit, a single removed repository, or a single URL that stops working does not prove the wider campaign is contained.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesApiiro also describes repositories tied to accounts that appear to belong to real developers. In some cases lure commits were injected into repositories those developers did not own. The report separates three groups: throwaway-looking accounts, suspected account takeovers, and a smaller set where the evidence is stronger. A developer’s name on a repository is therefore not proof that the developer published it.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The AI skills and MCP server variant
Island’s July 2026 research, as summarized by The Hacker News on July 20, 2026, described a related pattern it called “AgentBaiting.” An AI agent searching for a skill or a Model Context Protocol (MCP) server can land on a malicious repository and follow the README instructions it finds there. Island reported more than 800 disguised AI skill or MCP server repositories among nearly 7,600 malicious repositories in that earlier snapshot.
That figure belongs to July and to this lure pattern. It does not mean that every October repository uses the same disguise, and it does not mean that every agent, plugin, or listing is affected. Apiiro’s guidance for installing AI skills and MCP servers is to verify the repository owner and to obtain the component from an official registry or the vendor’s own repository. A convincing README, a high search ranking, a star count, or a registry-style listing is not enough on its own.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How to check a repository before you download anything
- Confirm the publisher. The owner should match the organization or developer that publicly maintains the project. Check that the project’s official website or documentation links to the repository.
- Prefer documented releases. A release on the project’s official releases page, or a package from a known registry, is easier to verify than a ZIP stored in a repository’s file tree.
- Be cautious of unusual install instructions. A README that asks you to download an archive and run an executable or script, in place of a standard package-manager command, is a warning sign.
- Do not treat popularity as proof. Stars, forks, search placement, and a polished README can all be copied or purchased.
- Verify AI skills and MCP servers at the source. Install them from an official registry or the vendor’s repository, and check the publisher named there.
If you visited a lure page or downloaded a file
Your next step depends on what you did, not on the campaign’s size.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- You only viewed the page. Do not download the ZIP. Leave the page and report the repository through the platform’s abuse or malware reporting channels. A report does not guarantee that every copy is removed, so keep your own protections in place.
- You downloaded the archive but did not open or run it. Do not extract or execute it. Delete it and check whether anything else was downloaded in the same session.
- You may have run the archive or a script from it. Treat this as both a malware and an account-security incident. Apiiro’s recommendation is to revoke active GitHub sessions and access tokens, then move your account to passkeys. Verify the repository’s ownership and obtain any replacement software from official sources.
Published guidance from these sources does not provide a verified, device-level cleanup sequence that is safe to follow step by step, and no reliable list of device indicators has been published for consumers. If the affected machine is a work device or holds developer credentials, bring in your organization’s security team or a qualified incident responder. Until the machine has been assessed, avoid using it to change sensitive passwords, tokens, or recovery settings, because it may still be able to capture new ones.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
For account security more broadly, Apiiro’s recommendation to move to passkeys is the step that most directly reduces the value of stolen passwords and session material for GitHub accounts.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
