Sneaky, Malicious MCP Server Exfiltrates Secrets via BCC

Hundreds of organisations may be unknowingly funneling emails containing passwords, API keys, financial details and other sensitive data straight to a threat actor through a poisoned MCP server known as postmark-mcp. The malware was uncovered by Koi Security on the npm repository, where it masqueraded as a legitimate tool for enabling AI assistants to send automated emails via Postmark’s platform, according to Koi Security.

Researchers found that the tool contained a single line of code that ensured the threat actor would receive a copy of every email sent through the compromised package, including sensitive credentials and financial information. The first 15 versions of postmark-mcp were legitimate, but in version 1.0.16 the engineer added a BCC command in line 231 to copy all emails to the attacker, with the line described as a “Bcc: [email protected]”.

It is estimated that some 1,500 organisations may have downloaded the malicious package, and if only 20% are using it, around 300 organisations could be sending emails containing sensitive data directly to cybercriminals, according to Dardikman of Koi Security.