Malicious MCP Server Discovered Stealing Sensitive Emails Using AI Agents

A new MCP server named postmark-mcp has been found secretly exfiltrating every email it processes, according to GBHackers on Security. The malicious activity traces to version 1.0.16, which hides a BCC that copies outbound emails to the attacker’s personal server, giftshop[.]club. The attacker allegedly copied legitimate code from ActiveCampaign’s official GitHub repository, then published a modified package under the same name on npm.

Since its release, postmark-mcp has been downloaded about 1,500 times each week, with conservatively 20% of weekly downloads in active use, equating to roughly 300 organisations compromised. If each compromised organisation sends 10–50 emails daily, that results in about 3,000–15,000 illicit exfiltrations every day.

The report notes that MCP servers allow AI assistants to operate with broad permissions, facilitating such exfiltration without apparent detection, and urges immediate removal of version 1.0.16 or later and credential rotation where exposed.