Executive Summary
On 21 July 2026, Cyber Security News reported a novel AI-themed malware distribution campaign (AgentBaiting) has emerged alongside a sustained wave of data breaches and ransomware attacks targeting retail organizations across Europe and North America. Threat actors are exploiting both cutting-edge AI tooling ecosystems and traditional third-party/supply-chain weaknesses to exfiltrate customer data at scale.
Key Takeaways
- A newly documented campaign called AgentBaiting uses fraudulent AI Skills and Model Context Protocol (MCP) servers to distribute SmartLoader malware through trusted-looking GitHub projects and public capability catalogs.
- Researchers identified approximately 7,600 malicious repositories created by roughly 6,600 profiles, including more than 800 posing as AI Skills or MCP servers.
TTPs (MITRE ATT&CK)
TTP | MITRE ID | Description |
Supply Chain Compromise | Malicious packages distributed via GitHub and AI registries | |
Masquerading | Fake AI Skills/MCP servers mimicking legitimate tools | |
Scheduled Task Persistence | Variants create scheduled-task persistence and retrieve encrypted stages from GitHub. | |
Obfuscated Files | Archives contain obfuscated Lua programs disguised as text files. | |
Credential Theft | StealC injected to steal browser sessions, credentials, and tokens | |
C2 via Blockchain | Command server located through a value stored in a Polygon smart contract. | |
Data Exfiltration | Customer PII exfiltrated across multiple retail breaches | |
Ransomware | DragonForce and Akira deployed against retail targets | |
Phishing (follow-on) | Stolen PII enables highly targeted follow-on phishing campaigns |
Indicators of Compromise (IOCs)
The following are confirmed SmartLoader package hashes from the AgentBaiting campaign. All hashes below are SHA-256 and linked to malicious GitHub repositories:
SHA-256 Hash | Associated Lure |
216a2c99fd42c00f9323d8b16dd19f622f7f4778b2b1d7cf07a3de5621f2 | Fake AI agent (yu-ai-agent) |
91e5dbfaf45edf25fbc2168f92083e05dfa427afa7633e991392e33cc743 | Fake Claude Skills |
498fe8fb806cd0e6685f97fc7d74de769dae5a28cdc821557b7585ad5ad | Fake AI agent Skills |
62744baa8077bb8be237647fd78e3bea2ca0932bf4be3d5618600f971185 | Fake Security MCP |
1da8df487d30b988f3c350c065206726aaa13f079a07151cd42ab557999 | Fake Claude Code plugins |
c15693106682f2ddb26649cab6e1962a64537627cde4c5d3c79d5a0be8c7 | Fake Walmart MCP |
66afc7d87d10dbe392898c4e5c613e0442fabb396415c2bef3a5ef2ac758 | Fake Databricks MCP |
a33f40cab1ab7f971d3464af3e7595918107332b9e83342007571842b9e | Fake Jenkins MCP |
3c858facbad66f5479e2c4add171421dc1b6488b36f33e7cff073aba585 | Fake Docker MCP gateway |
fc1278f419e611bf40ca414099bfd9ad98a31ffb054371e8cb65a84849b | Fake Alibaba Cloud Skills |
425bd5f4d864097bd06e36b66dfdc7c9d8914abb4e4fb84b839a3838fcb7dc0b | DragonForce (Kee Wah Bakery) |
7bde44edf56a4636eee176139622e18beb9e0f84326a986cdd3a393c023f3508 | Akira (NTD Apparel) |
Mitigation Options
AI/MCP Tooling Controls
- Rely on a curated and reviewed catalog for Skills, MCP servers, and agent plug-ins instead of unrestricted discovery. Test new capabilities in an isolated environment without browser sessions, cloud credentials, SSH keys, or production data.
- Reject any supposed AI capability distributed as a Windows ZIP containing a launcher and hidden payload. Verify publishers as carefully as projects: star counts, copied profiles, and registry listings do not establish legitimacy.
- Monitor downloads, Git clones, shell commands, and changes to MCP or Skill configurations initiated by agents. Maintain an inventory of each capability’s repository, commit, version, and package hash to speed investigation.
Incident Response (SmartLoader/StealC)
- If SmartLoader execution is suspected, isolate the endpoint and revoke active browser sessions, OAuth grants, API tokens, cloud credentials, and developer credentials. Password resets alone may not be sufficient because StealC can steal live sessions, browser data, email and remote-access credentials, screenshots, and host details.
Supply Chain & Third-Party Risk
- Enforce strict vendor security assessments with contractual incident notification requirements, particularly for providers with access to customer databases.
- Implement network segmentation to limit lateral movement in the event of a third-party compromise.
- Monitor for dark web exposure of organizational credentials and customer PII on an ongoing basis.
Ransomware Preparedness
- Maintain tested, offline backups and conduct tabletop exercises specific to DragonForce and Akira TTPs.
- Deploy endpoint detection and response (EDR) capable of identifying infostealer activity, which ransomware monitoring associated with the Kee Wah incident identified as a precursor vector.
