SleeperGem & AgentBaiting: Defending Against Supply Chain and AI Ecosystem Compromise

The July 2026 threat landscape has shifted decisively toward the poisoning of the development and AI ecosystems. The latest Security Affairs malicious software newsletter (Round 107) highlights two critical, active campaigns: SleeperGem and AgentBaiting. These are not theoretical proofs-of-concept; they are active intrusion campaigns targeting the foundational tools used by software engineers and AI integrators.

SleeperGem focuses on compromising widely trusted utilities, specifically the git_credential_manager and fastlane RubyGems, to deploy persistent unauthorized access mechanisms. Simultaneously, AgentBaiting demonstrates the weaponization of the AI supply chain, utilizing over 800 fake AI skills and malicious Model Context Protocol (MCP) servers to deliver malware.

For defenders, this represents a collapse of the traditional perimeter. Your build pipelines and AI agent tooling are now the frontline. If your organization develops software or consumes AI services, immediate action is required to identify and evict these persistence mechanisms.

Technical Analysis

SleeperGem: The Developer Tool Compromise

SleeperGem represents a sophisticated supply chain attack targeting the software development lifecycle (SDLC).

Affected Products:
- git_credential_manager: Critical for authenticating with Git repositories (GitHub, Azure DevOps, etc.).
- fastlane: A popular automation tool for iOS and Android developers, distributed via RubyGems.
- Dendreo: A specific target indicating broader software supply chain exposure.
Mechanism of Attack: Attackers are either compromising legitimate package maintainers or publishing typosquatted packages. Once installed, the malicious payloads overwrite or hook into standard authentication flows (git_credential_manager) or build scripts (fastlane). This allows the attacker to harvest credentials (OAuth tokens, SSH keys) or establish a reverse shell/persistent backdoor within the build environment.
Impact: Complete compromise of source code repositories and CI/CD pipelines. The "persistent unauthorized access mechanism" suggests the malware installs itself deeply enough to survive standard reboots or tool updates.

AgentBaiting: AI Ecosystem Poisoning

AgentBaiting signals the maturation of AI-focused malware delivery.

Vector: The campaign leverages the trust model of AI assistants and agents. By publishing over 800 "Fake AI Skills" and malicious MCP (Model Context Protocol) servers, attackers trick users or automated agents into downloading and executing arbitrary code.
Mechanism: MCP servers are designed to give AI agents access to external tools and data. A malicious MCP server can execute shell commands, exfiltrate data, or download second-stage payloads (like ransomware droppers) under the guise of performing a task for the AI.

UAC-0145 and msaRAT

The newsletter attributes these vectors to UAC-0145, a threat cluster known for aggressive credential harvesting. Additionally, the Chaos encryption-based incident referenced highlights the use of msaRAT, a Remote Access Trojan likely deployed as a secondary payload following initial access via the methods above.

Detection & Response

Given the lack of specific CVEs in this supply chain campaign, detection relies heavily on behavioral analysis. We are hunting for package managers spawning unauthorized shells and suspicious network activity from development tools.

SIGMA Rules

YAML

---
title: Potential SleeperGem - Package Manager Spawning Shell
id: 8f5c3d12-1a9b-4c5e-9f0d-6a7b8c9d0e1f
status: experimental
description: Detects package managers (gem, npm) spawning cmd or powershell, common in malicious packages like SleeperGem.
references:
  - https://securityaffairs.com/196037/malware/security-affairs-malware-newsletter-round-107.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.execution
  - attack.t1059.001
  - attack.supply_chain
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\gem.exe'
      - '\npm.cmd'
      - '\npx.cmd'
      - '\ruby.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\pwsh.exe'
  condition: selection
falsepositives:
  - Legitimate build scripts running post-install scripts
level: high
---
title: Suspicious Git Credential Manager Network Activity
id: 3e4d5c6b-7a8f-9e01-2b3c-4d5e6f7a8b9c
status: experimental
description: Detects git-credential-manager or git processes connecting to non-standard endpoints or internal IP ranges (C2 beacons).
references:
  - https://securityaffairs.com/196037/malware/security-affairs-malware-newsletter-round-107.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\git-credential-manager.exe'
      - '\git.exe'
    DestinationPort|not:
      - 22
      - 443
      - 80
  condition: selection
falsepositives:
  - Internal Git servers on custom ports
level: medium
---
title: AgentBaiting - Suspicious MCP Server Execution
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects execution of unsigned or suspicious binaries in common MCP server paths or as child processes of AI agent wrappers.
references:
  - https://securityaffairs.com/196037/malware/security-affairs-malware-newsletter-round-107.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.execution
  - attack.t1204
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - 'mcp-server'
      - 'claude-code'
    Image|endswith:
      - '.exe'
      - '.bat'
      - '.cmd'
  filter:
    Signed: 'true'
  condition: selection and not filter
falsepositives:
  - Verified custom MCP servers
level: high

KQL (Microsoft Sentinel)

This query hunts for suspicious process lineage involving package managers and AI tools, flagging potential SleeperGem or AgentBaiting activity.

KQL — Microsoft Sentinel / Defender

DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("gem.exe", "npm.cmd", "npx.cmd", "node.exe", "ruby.exe")
| where ProcessFileName in~ ("powershell.exe", "cmd.exe", "pwsh.exe", "bash.exe", "wscript.exe", "cscript.exe")
| extend FullCommandLine = ProcessCommandLine
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessFileName, FullCommandLine, SHA256
| order by Timestamp desc

Velociraptor VQL

Use this artifact to hunt for the specific files mentioned in the SleeperGem report or suspicious recent modifications in RubyGem directories.

VQL — Velociraptor

-- Hunt for SleeperGem indicators in Rubygems paths
SELECT FullPath, Size, Mtime, Mode
FROM glob(globs="/*/gems/**/*")
WHERE Mtime > ago(date("-7d"))
  AND (FullPath =~ "fastlane" OR FullPath =~ "git_credential")
  AND Mode =~ "x"

-- Hunt for suspicious MCP server processes
SELECT Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE Name =~ "mcp" OR CommandLine =~ "--mcp"

Remediation Script (PowerShell)

Run this script on developer workstations to verify the integrity of fastlane and check for common persistence mechanisms associated with SleeperGem.

PowerShell

# SleeperGem Remediation Audit
Write-Host "[+] Auditing RubyGems for fastlane integrity..."

# Check if fastlane is installed and get version
try {
    $fastlaneVersion = gem list fastlane
    if ($fastlaneVersion) {
        Write-Host "[!] Found fastlane installation: $fastlaneVersion"
        
        # Locate the actual gem directory
        $gemPath = gem environment gemdir
        $fastlanePath = Join-Path $gemPath "gems\fastlane-*"
        
        if (Test-Path $fastlanePath) {
            Write-Host "[+] Scanning $fastlanePath for recent modifications..."
            Get-ChildItem -Path $fastlanePath -Recurse -File | 
                Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) } | 
                Select-Object FullName, LastWriteTime
        }
    }
} catch {
    Write-Host "[-] Error checking RubyGems: $_"
}

# Audit Git Credential Manager (Check for unsigned binaries in common paths)
Write-Host "[+] Auditing Git Credential Manager..."
$gcmPaths = @(
    "$env:LOCALAPPDATA\Programs\Git",
    "$env:ProgramFiles\Git",
    "$env:ProgramFiles\Git\mingw64\bin"
)

foreach ($path in $gcmPaths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Filter "git-credential-manager*" -File | 
            ForEach-Object {
                $sig = Get-AuthenticodeSignature $_.FullName
                if ($sig.Status -ne "Valid") {
                    Write-Host "[!] UNVERIFIED SIGNATURE FOUND: $($_.FullName) - Status: $($sig.Status)"
                }
            }
    }
}

Write-Host "[+] Audit complete. If unverified files or recent modifications are found, re-install tools from official sources immediately."

Remediation

To address the SleeperGem and AgentBaiting threats, organizations must move beyond simple patching to integrity verification:

Verify Package Integrity: Do not assume current installations are safe. Uninstall fastlane and git_credential_manager and re-download them directly from the official GitHub repositories or vendor sites. Verify the digital signatures of the installers.
Rotate CI/CD Credentials: Treat all SSH keys, OAuth tokens, and API keys stored in git_credential-manager or environment variables on affected machines as compromised. Rotate them immediately.
Inventory AI Integrations: Audit all installed "AI Skills" and configured MCP servers. Remove any that are not from verified, trusted vendors. Block network access to known-malicious MCP endpoints (if intelligence is available) or restrict egress from AI agent tooling.
Supply Chain Policy: Enforce dependency pinning (e.g., using package-lock. or Gemfile.lock) and require manual review for any dependency updates in the short term.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub