Cybersecurity researchers have uncovered a new SmartLoader campaign that distributes a trojanized version of an Oura Health Model Context Protocol (MCP) server. This malicious server, which normally connects AI assistants to Oura Ring health data, has been cloned and altered by threat actors to deliver the StealC infostealer, compromising user data and system security.

The attack leverages the legitimate appearance of the Oura MCP server to deceive users into installing the malware, highlighting the growing trend of abusing trusted tools in cyberattacks. This incident underscores the importance of verifying software sources and implementing robust security measures to protect against such sophisticated threats.

Key Takeaways

  • SmartLoader campaign uses a trojanized Oura MCP server to deploy StealC infostealer
  • Threat actors cloned a legitimate Oura Health tool to deceive users
  • Attack targets AI assistants connected to Oura Ring health data
  • Emphasizes the risk of malware disguised as trusted software
  • Highlights need for vigilance in software verification and cybersecurity practices

Source: The Hacker News