Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-03-02 · source-backed
Threat actors cloned the legitimate Oura Ring MCP server on GitHub, manufactured credibility with fake forks and contributors, then distributed a trojanized version via ZIP archive. When installed, it executes an obfuscated Lua script deploying SmartLoader → StealC infostealer to exfiltrate browser passwords, API keys, and crypto wallets. This marks a deliberate pivot from targeting piracy seekers to targeting developers, whose machines contain production credentials. Recommended: inventory installed MCP servers, verify GitHub repo origins against official sources, never install MCP servers from ZIP archives. The Hacker News
Each link below shares sources, entities, or timing with this story.
Windsurf uses MCP / Shared entities / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Windsurf uses MCP); both cover GitHub, MCP; overlapping topics (against, chain, server).
Claude Code uses MCP / Shared entities / What happened next
Linked by a graph relationship (Claude Code uses MCP); both cover GitHub, MCP, When; picks up the GitHub thread on 2026-06-07.
Claude Code uses MCP / Shared entities / Same source domain / What happened next
Linked by a graph relationship (Claude Code uses MCP); both cover MCP, The Hacker News; reported by the same outlet (thehackernews.com).