Malicious MCP Server Discovered Stealing Sensitive Email Data Through AI Agents
· Source: cyberpress.org
In short
A malicious Model Context Protocol (MCP) server named postmark-mcp has been discovered stealing thousands of emails daily through AI assistant integrations, marking a new type of supply chain attack. The compromised package has been downloaded widely and quietly exfiltrated sensitive email data since version 1.0.16, affecting approximately 300 organizations and exposing critical information. Security researchers urge immediate removal and credential rotation.
Read Original Article — Read the full article on the publisher’s site.
In the issue of week 39, 2025: Agentic AI Drives Supply Chain Autonomy, Cutting Costs and Boosting Throughput
Tags: supply chain, cybersecurity, email, exfiltration, AI, attack