Skip to content
PERMISSION/PROTOCOL
Back to incident tracker

2026-02-01

HighMedia report

SmartLoader Group Cloned Oura Ring MCP Server with Fake Contributor Ecosystem to Deliver StealC Infostealer Targeting Developer Credentials

SmartLoader group cloned the legitimate Oura Ring MCP server and built a fake contributor ecosystem for credibility. Listed on public MCP registries, the trojanized server deployed StealC infostealer harvesting passwords, API keys, and crypto wallet data from developer environments.

Oura Ring MCP (trojanized)Credential exposureTrojanized MCP server: supply chain infostealer via registry poisoningDeveloper environments / API keys / crypto wallets

What happened

SmartLoader listed a trojanized clone of the Oura Ring MCP server on public MCP registries. The clone included StealC infostealer payload that activated on installation, harvesting developer credentials including passwords, API keys, and crypto wallet private keys.

Why it matters

Developer credentials including API keys, passwords, and crypto wallet private keys exfiltrated to SmartLoader infrastructure. Any developer who installed the trojanized server from a public MCP registry was at risk of full credential compromise.

Missing authorization check

Not applicable: no agent authorization boundary was crossed in this incident.

Would PP block it?

The compromise ran through package, credential, or vendor infrastructure rather than through an agent tool call, so there is no agent action for an authorization gate to hold.

Incident analysis

Timeline and technical read

Timeline

  1. 2026-02-01

    SmartLoader group publishes trojanized Oura Ring MCP server clone on public MCP registries with fabricated contributor ecosystem for credibility.

  2. 2026-02-01

    Security researchers identify the malicious server. StealC infostealer payload confirmed. Server removed from public registries.

Technical breakdown

  • SmartLoader cloned the legitimate Oura Ring MCP server repository and modified it to include StealC infostealer payload.
  • Fake contributor accounts, commit history, and community activity were created to make the clone appear legitimate and actively maintained.
  • The trojanized server was listed on multiple public MCP registries, leveraging registry discovery mechanisms to reach developers.
  • StealC payload activated on installation, targeting password managers, API key files, and crypto wallet data in standard developer environment paths.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Credential exposure. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at
MCP server tool execution, credential file access gate
Still needs
MCP registry package verification; MCP server code signing; installer sandbox
Receipt required for
MCP server installation, access to credential files and password stores

No agent took an action in this incident. Permission Protocol gates what an agent does, so it does not apply where the harm required no agent action.

Start small

Put the relevant gate at this action boundary.

This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop