Loading story…
Researchers reported a supply-chain campaign in which SmartLoader operators cloned a legitimate Oura MCP Server project (used to connect AI assistants to Oura Ring health data) and used a deceptive GitHub ecosystem to distribute a trojanized version that installs the StealC information stealer. The operation relied on fake GitHub accounts, manufactured “community” signals (e.g., forks/contributors), and placement of the malicious server into public MCP registries to increase the likelihood that developers would download it.
Once installed, the trojanized MCP server deployed StealC, which is designed to steal sensitive data including developer credentials, browser-stored passwords, and cryptocurrency wallet information. Reporting highlighted this as a tactical shift: threat actors with established software supply-chain tradecraft are now targeting the emerging MCP ecosystem used by AI tooling, increasing the risk of credential theft, data exfiltration, and downstream compromise for organizations adopting MCP-enabled AI assistants and developer workflows.
Trace attribution and downstream blast radius.
4 events from the most recent confirmed update back to the earliest known activity.
Straiker’s AI Research (STAR) Labs reported the campaign, linking the infrastructure and tradecraft to known SmartLoader patterns and noting indicators consistent with China-based operations, while warning of growing supply-chain risk in MCP ecosystems.
When downloaded and installed, the malicious MCP server deployed the StealC information stealer, using LuaJIT, VM-style obfuscation, and scheduled-task persistence disguised as Realtek drivers to steal credentials, browser passwords, wallet data, and other secrets.
After establishing trust around the cloned project, the attackers published a separate malicious repository and submitted a trojanized Oura MCP server package to public MCP registries to target developers seeking Oura integrations.
Over a period of months, attackers cloned a legitimate Oura MCP Server project and used multiple fake GitHub accounts, AI-generated personas, fake forks, and cross-referenced activity to make the project appear credible and widely adopted.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are using cloned GitHub repositories that impersonate AI and developer tools to infect users with a multi-stage **SmartLoader** chain that ends in infostealer deployment, according to reporting from Netskope Threat Labs and related indicator data. The campaign targets AI users and developers, with observed victim concentration in North America, Asia, and Southern Europe, particularly across financial services, banking, and technology organizations. Netskope said the final payload includes a previously reported NodeJS-based Malware-as-a-Service infostealer, turning developer interest in AI tooling into a potential enterprise initial-access vector. The infection chain relies on Windows-hosted Lua components packaged in ZIP archives and staged through files including `lua51.dll`, a renamed interpreter such as `compiler.exe`, `Application.bat`, obfuscated Lua payloads such as `dist.lua`, and follow-on executables including `7d7752.exe`. Both SmartLoader stages reportedly retrieve command-and-control data dynamically from a Polygon blockchain smart contract using **EtherHiding**, with supporting indicators showing Polygon RPC endpoints, `eth_call` activity, an Ethereum-style wallet address, and GitHub-hosted files tied to accounts including `yawalinte` and `JuliusMAAR`. Netskope also found signs of **Prometheus** obfuscation in the first-stage Lua payload and **MoonSec V3**-style obfuscation in the second stage, indicating a resilient loader design that lets operators rotate C2 infrastructure without changing malware code.
Aug 4, 2026
Multiple reports describe threat actors abusing *AI-adjacent* and open-source distribution channels to deliver malware or manipulate automated agents. Straiker STAR Labs reported a **SmartLoader** campaign that trojanized a legitimate-looking **Model Context Protocol (MCP)** server tied to *Oura* by cloning the project, fabricating GitHub credibility (fake forks/contributors), and getting the poisoned server listed in MCP registries; the payload ultimately deployed **StealC** to steal credentials and crypto-wallet data. Separately, researchers observed attackers using trusted platforms and SaaS reputations for delivery and monetization: a fake Android “antivirus” (*TrustBastion*) was hosted via **Hugging Face** repositories to distribute banking/credential-stealing malware, and Trend Micro documented spam/phishing that abused **Atlassian Jira Cloud** email reputation and **Keitaro TDS** redirects to funnel targets (including government/corporate users across multiple language groups) into investment scams and online casinos. In parallel, research highlights emerging risks where **AI agents and AI-enabled workflows become the target or the transport layer**. Check Point demonstrated “**AI as a proxy**,” where web-enabled assistants (e.g., *Grok*, *Microsoft Copilot*) can be coerced into acting as covert **C2 relays**, blending attacker traffic into commonly allowed enterprise destinations, and outlined a trajectory toward prompt-driven, adaptive malware behavior. OpenClaw featured in two distinct security developments: an OpenClaw advisory described a **log-poisoning / indirect prompt-injection** weakness (unsanitized WebSocket headers written to logs that may later be ingested as trusted context), while Hudson Rock reported an infostealer incident that exfiltrated sensitive **OpenClaw configuration artifacts** (e.g., `openclaw.json` tokens, `device.json` keys, and “memory/soul” files), signaling that infostealer operators are beginning to harvest AI-agent identities and automation secrets in addition to browser credentials.
Jun 29, 2026
Researchers reported a large-scale GitHub malware distribution campaign that has operated since March 2025, using repositories masquerading as cracked browser extensions, gaming cheats, developer tools, and, more recently, fake AI skills and MCP servers. The activity has been tied to a Vietnamese-speaking operator and spans more than 47 GitHub accounts and 600 malicious ZIP archives, with some accounts believed to have been compromised rather than created solely for abuse. The campaign’s social-engineering lures target both general users and developers seeking unofficial software, automation tools, or AI-related components. The repositories deliver a multi-stage **LuaJIT** loader chain that ultimately installs the **StealC** information stealer. Payloads are fetched from GitHub “dead drop” repositories, then decrypted through layered obfuscation including hex, XOR, `base64url`, and **AES-ECB** before process hollowing is used for injection. Researchers said the malware also resolves command-and-control infrastructure through **Polygon Mainnet** smart contracts, allowing operators to rotate C2 URLs or IPs without changing deployed binaries; telemetry linked the activity to detections such as BitDefender `Gen:Heur.FakeGit.1` and ESET’s `Lua/Agent` family, while infrastructure usage heavily overlapped with bulletproof hosting providers including **ASN 207957 (Serv.host Group Ltd)**.
Jul 22, 2026