Threats

SmartLoader Campaign Trojanizes Oura MCP Server With Fake GitHub Network to Deploy StealC Infostealer

Zero Day Wire

17 Feb 2026 — 2 min read

A new SmartLoader campaign is targeting developers through trojanized AI tooling — cloning a legitimate Model Context Protocol (MCP) server for Oura Health's smart ring and distributing it through the MCP Market registry to deliver the StealC infostealer.

The campaign, documented by Straiker's AI Research (STAR) Labs, represents a shift in SmartLoader operations from targeting users seeking pirated software to deliberately targeting developers — whose systems contain API keys, cloud credentials, cryptocurrency wallets, and access to production environments.

Months of Manufactured Trust

Unlike typical malware campaigns that prioritize speed, this operation invested months building credibility before deploying any payload. The attack unfolded in four stages:

Created fake personas — at least five bogus GitHub accounts (YuzeHao2023, punkpeye, dvlan26, halamji, yzhao112) were established to build a collection of seemingly legitimate repository forks of the real Oura MCP server
Built the weaponized repo — a new Oura MCP server repository containing the malicious payload was created under the account "SiddhiBagul"
Manufactured contributor credibility — the fake accounts were added as "contributors" to the malicious repo while deliberately excluding the original legitimate author from contributor lists
Submitted to MCP Market — the trojanized server was listed on the MCP Market registry, where it appeared alongside legitimate alternatives — and remains listed as of publication

Users searching for the Oura MCP server on the registry would find the rogue version among benign results, with no obvious indicators that it was malicious.

Infection Chain

Once a victim downloads and launches the trojanized MCP server via its ZIP archive, the infection proceeds through a straightforward chain:

An obfuscated Lua script executes and drops SmartLoader
SmartLoader deploys StealC, a widely-used infostealer
StealC harvests credentials, browser passwords, and cryptocurrency wallet data

The stolen data provides attackers with the materials needed for follow-on intrusions — cloud account access, API keys, and production system credentials from developer machines represent significantly higher-value targets than typical consumer data.

AI Tooling as an Attack Surface

SmartLoader's evolution mirrors a broader trend. The campaign previously relied on AI-generated lures disguised as game cheats and cracked software on GitHub. By pivoting to trojanized MCP servers — tools that connect AI assistants to external data sources — the operators are exploiting a new attack surface where security review processes haven't caught up with adoption speed.

This is the second major incident involving poisoned AI developer tooling in recent days, following the discovery of infostealers targeting OpenClaw AI agent configuration files and gateway tokens.

Defender Recommendations

Inventory all installed MCP servers and verify their origin against official sources
Establish formal security review processes before installing any MCP server
Verify GitHub repository legitimacy — check contributor history, account age, and whether the original author is present
Monitor for suspicious egress traffic and unexpected persistence mechanisms following MCP server installation
Treat MCP registries with the same caution as npm or PyPI — community registries are not curated and can be poisoned

PayPal Confirms Six-Month Data Exposure After Loan System Code Error Leaked Social Security Numbers

PayPal has confirmed a data exposure incident affecting its Working Capital (PPWC) business loan service, where a software code change left sensitive customer information accessible for nearly six months before being detected. The exposure ran from 1 July 2025 to 12 December 2025, when the error was finally discovered and

AWS Reports 600+ FortiGate Firewalls Compromised in AI-Augmented Campaign by Russian-Speaking Cybercrime Group

A financially motivated Russian-speaking cybercrime group compromised more than 600 internet-exposed FortiGate firewalls across 55 countries in just over a month, using off-the-shelf generative AI tools to scale an operation that would traditionally require a well-resourced team, according to a new incident report from AWS. The campaign, which ran from

ClickFix Campaign Compromises Legitimate Sites to Deploy MIMICRAT — A Custom C++ RAT With 22 Post-Exploitation Commands

Elastic Security Labs has disclosed a new ClickFix campaign that leverages compromised legitimate websites as delivery infrastructure to deploy a previously undocumented remote access trojan dubbed MIMICRAT (also tracked as AstarionRAT). The campaign, discovered earlier this month, demonstrates significant operational sophistication — from multi-stage PowerShell chains that bypass Windows security controls

ShinyHunters Linked to Device Code Vishing Attacks Targeting Microsoft Entra Accounts via OAuth 2.0 Abuse

A new wave of attacks is combining voice phishing (vishing) with OAuth 2.0 device authorization abuse to compromise Microsoft Entra accounts at technology, manufacturing, and financial organizations — bypassing traditional phishing infrastructure entirely. Sources told BleepingComputer they believe the ShinyHunters extortion gang is behind the campaigns, which the threat actors