Back Securityaffairs.Co

SmartLoader hackers clone Oura MCP project to spread StealC malware

Securityaffairs.Co •Pierluigi Paganini • February 17, 2026

Hackers used a fake Oura MCP server to trick users into downloading malware that installs the StealC info-stealer. Straiker’s AI Research (STAR) Labs team uncovered a SmartLoader campaign in which attackers cloned a legitimate MCP server linked to Oura Health to spread the StealC information stealer. The fake project appeared credible, complete with bogus forks […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SmartLoader Campaign Uses Fake Oura MCP Server to Distribute StealC Malware Hackers exploited a cloned Oura MCP server to distribute the StealC info-stealer malware. The attack was uncovered by Straiker’s AI Research (STAR) Labs, revealing that the fake project was designed to appear legitimate, complete with counterfeit forks to deceive users into downloading the malware. 2 sources 37

Extracted Entities

SmartLoader hackers clone Oura MCP project to spread StealC malware

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Malware (1)