SmartLoader Attack Uses Trojanized Oura MCP Server to Deploy StealC Infostealer

Cybersecurity researchers have uncovered a sophisticated new attack campaign that demonstrates how threat actors are weaponizing trusted AI infrastructure to deliver malware. The SmartLoader campaign, detailed by Straiker's AI Research (STAR) Labs team, involves distributing a trojanized version of the Model Context Protocol (MCP) server associated with Oura Health to deliver the StealC information stealer.

The Anatomy of a Trust-Based Supply Chain Attack

The attack represents a significant evolution in malware distribution tactics. Rather than relying on traditional methods like fake game cheats or cracked software, threat actors have created an elaborate network of bogus GitHub accounts and repositories to serve trojanized MCP servers.

"The threat actors cloned a legitimate Oura MCP Server – a tool that connects AI assistants to Oura Ring health data – and built a deceptive infrastructure of fake forks and contributors to manufacture credibility," the researchers explained.

The campaign unfolded methodically over several months:

• Creation of at least five fake GitHub accounts (YuzeHao2023, punkpeye, dvlan26, halamji, and yzhao112) to build seemingly legitimate repository forks
• Development of a malicious Oura MCP server repository under a new account "SiddhiBagul"
• Strategic addition of fake accounts as "contributors" to lend credibility
• Submission of the trojanized server to legitimate MCP registries like MCP Market

Why This Attack Matters

Unlike opportunistic malware campaigns that prioritize speed and volume, SmartLoader invested months building credibility before deploying their payload. This patient, methodical approach demonstrates the threat actor's understanding that developer trust requires time to manufacture, and their willingness to invest that time for access to high-value targets.

The attack essentially exploits a fundamental weakness in how organizations evaluate AI tooling. By poisoning MCP registries and weaponizing platforms like GitHub, threat actors leverage the trust and reputation associated with these services to lure unsuspecting users into downloading malware.

Technical Execution and Payload Delivery

Once launched via a ZIP archive, the trojanized server executes an obfuscated Lua script responsible for dropping SmartLoader. This malware loader then proceeds to deploy StealC, an information stealer capable of harvesting credentials, browser passwords, and data from cryptocurrency wallets.

The evolution of the SmartLoader campaign indicates a strategic shift from attacking users looking for pirated software to targeting developers. This represents a more lucrative approach, as developer systems contain sensitive data such as API keys, cloud credentials, cryptocurrency wallets, and access to production systems.

The stolen data could then be abused to fuel follow-on intrusions, creating a cascading effect of security compromises.

The Broader Implications for AI Security

This campaign exposes fundamental weaknesses in how organizations evaluate AI tooling. SmartLoader's success depends on security teams and developers applying outdated trust heuristics to a new attack surface.

The MCP server is still listed on the MCP directory, meaning users searching for the Oura MCP server on the registry would find the rogue server listed among other benign alternatives. This highlights the challenge of securing emerging AI infrastructure and the need for more robust verification mechanisms.

Recommended Mitigations

Organizations are advised to implement several key security measures to combat this evolving threat:

1. Inventory installed MCP servers - Maintain a comprehensive list of all MCP servers in use across the organization

2. Establish formal security review processes - Implement mandatory security reviews before installing any MCP servers

3. Verify server origins - Cross-reference MCP servers with official sources and verify contributor authenticity

4. Monitor network traffic - Watch for suspicious egress traffic and persistence mechanisms that may indicate compromise

5. Educate development teams - Train developers to recognize signs of trojanized tooling and verify sources before installation

The Future of AI Supply Chain Security

The SmartLoader campaign represents a concerning trend in cybersecurity: the weaponization of trusted AI infrastructure. As AI tools become increasingly integrated into development workflows, they present an attractive target for threat actors seeking high-value data and persistent access.

This attack demonstrates that threat actors are willing to invest significant time and resources into building credibility within developer communities. The methodical approach suggests we may see more sophisticated, long-term campaigns targeting AI infrastructure in the future.

Organizations must adapt their security practices to account for these new attack vectors, implementing more rigorous verification processes for AI tooling and developing a healthy skepticism toward seemingly legitimate repositories and contributors.

The SmartLoader campaign serves as a wake-up call for the cybersecurity community: as AI infrastructure becomes more prevalent, so too will attacks targeting it. Proactive security measures and continuous vigilance will be essential to protect against these evolving threats.