← Catalog
Incident high discovered 2025-09-01

Poisoned Postmark MCP Server Exfiltrates Email

A popular MCP server for the Postmark email service was trojanized in a supply-chain 'rug pull': a new version silently BCC'd users' emails to an attacker. Every agent wired to the tool leaked mail automatically.

Resource Development Defense Evasion Initial Access Execution Exfiltration

What happened

Catalogued by MITRE ATLAS as AML.CS0053, a widely-used MCP server for the Postmark email service was trojanized in a supply-chain rug pull. After building trust, a new version of the tool silently began BCC-ing users’ outgoing email to an attacker-controlled address. Because MCP servers are wired directly into AI agents as tools, every agent that had adopted the server leaked mail automatically the moment it upgraded — no per-victim interaction needed.

MCP (the Model Context Protocol) is becoming the USB port for agent tools, and this is the classic dependency risk transplanted into the agent era: a trusted tool turns malicious in an update, and the blast radius is every agent that installed it.

Why it maps to ATLAS

  • AML.T0104 — Publish Poisoned AI Agent Tool: the malicious MCP version is published for agents to adopt.
  • AML.T0109 — AI Supply Chain Rug Pull: a trusted tool is turned malicious after gaining adoption.
  • AML.T0010.005 — AI Supply Chain Compromise: AI Agent Tool: the tool-distribution channel is subverted.
  • AML.T0011.002 — User Execution: Poisoned AI Agent Tool: agents run the poisoned tool.
  • AML.T0086 — Exfiltration via AI Agent Tool Invocation: the tool’s own actions carry email out.

Detection notes

Pin and hash-verify MCP tools like any other dependency, and review diffs before upgrading — rug pulls hide in the update, not the initial version. Give tools least-privilege scopes and alert on email actions that add unexpected recipients or reach new destinations. A pinned tool suddenly changing behavior or ownership is the signal.

Detection

Log sources

  • MCP tool version + integrity audit
  • Agent tool-invocation + outbound mail logs
  • Package registry publish history

Signals

  • A trusted MCP tool updated to a version adding covert BCC/forwarding
  • Agent email actions carrying an unexpected extra recipient
  • Maintainer/ownership or behavior change in a pinned agent tool

Mitigations

  • Pin + hash-verify MCP tool versions; review diffs before upgrade
  • Least-privilege tool scopes; alert on new recipients/egress
  • Prefer first-party/attested MCP servers; monitor for rug pulls