SOC Prime Bias: Critical

18 Feb 2026 16:17
newspaper icon straiker.ai

SmartLoader Clones the Oura Ring MCP to Stage a Supply-Chain Attack

Author Photo
Ruslan Mikhalov Chief of Threat Research at SOC Prime linkedin icon Follow
SmartLoader Clones the Oura Ring MCP to Stage a Supply-Chain Attack
shield icon

Detection stack

  • AIDR
  • Alert
  • ETL
  • Query


Summary

SmartLoader used fake GitHub accounts and a cloned Oura Ring MCP server to contaminate MCP registries. The trojanized server then delivered the StealC infostealer, designed to steal developer credentials, crypto-wallet data, and health information. The activity shows how AI-enabled health integrations can become a supply-chain foothold.

Investigation

Researchers mapped at least five fabricated GitHub profiles that forked the real Oura MCP repository and published lookalikes. A malicious fork was pushed under a new account and submitted to MCP registries. Dynamic analysis found LuaJIT-based payloads staged in the user AppData folder and persistence via scheduled tasks masquerading as Realtek audio drivers.

Mitigation

Audit MCP server inventories, enforce provenance checks before installation, and alert on scheduled tasks launching executables from AppData. Apply egress controls and block traffic to known cryptocurrency and C2 endpoints. Validate GitHub contributor history and repository lineage during approval.

Response

On detection, isolate the workstation, terminate the malicious tasks, remove unauthorized AppData executables, and rotate exposed credentials and API keys. Forensically review the compromised MCP server and tighten dependency vetting to prevent reinfection.

"graph TB %% Class Definitions classDef action fill:#99ccff classDef malware fill:#ffcc99 classDef process fill:#ff9999 classDef file fill:#cccccc classDef technique fill:#c0c0c0 %% Node definitions action_supply_chain["<b>Action</b> – <b>T1195.001 Supply Chain Compromise</b><br/><b>Description</b>: Adversary compromises a software supply chain to distribute malicious code."] class action_supply_chain action malware_trojanized_server["<b>Malware</b> – <b>Name</b>: Trojanized Oura MCP Server<br/><b>Purpose</b>: Delivered via compromised package."] class malware_trojanized_server malware action_developer_install["<b>Action</b> – <b>Install Package</b><br/><b>Description</b>: Developer installs the compromised MCP package."] class action_developer_install action file_resource_txt["<b>File</b> – <b>Name</b>: resource.txt<br/><b>Techniques</b>: T1027 Obfuscated Files, T1059 Command and Scripting Interpreter"] class file_resource_txt file malware_luajit_script["<b>Malware</b> – <b>LuaJIT Script</b><br/><b>Techniques</b>: T1027, T1059"] class malware_luajit_script malware process_odmw["<b>Process</b> – <b>Name</b>: ODMw.exe (LuaJIT interpreter)"] class process_odmw process process_odmy["<b>Process</b> – <b>Name</b>: ODMy.exe (LuaJIT interpreter)"] class process_odmy process tech_T1053["<b>Technique</b> – T1053 Scheduled Task/Job<br/><b>Description</b>: Create scheduled tasks for persistence."] class tech_T1053 technique process_task_odmw["<b>Process</b> – <b>Scheduled Task</b>: RealtekAudioManager_ODMw"] class process_task_odmw process process_task_odmy["<b>Process</b> – <b>Scheduled Task</b>: AudioManager_ODMy"] class process_task_odmy process malware_socket3["<b>Malware</b> – <b>Name</b>: socket3.lua (C2 payload)"] class malware_socket3 malware tech_T1102["<b>Technique</b> – T1102 Web Service<br/><b>Description</b>: Uses HTTP based web service for command and control."] class tech_T1102 technique tech_T1041["<b>Technique</b> – T1041 Exfiltration Over C2 Channel<br/><b>Description</b>: Sends stolen data via the C2 channel."] class tech_T1041 technique malware_stealc["<b>Malware</b> – <b>Name</b>: StealC Infostealer"] class malware_stealc malware tech_T1555_003["<b>Technique</b> – T1555.003 Credentials In Files: Browser Passwords/Cookies<br/><b>Description</b>: Steals saved browser credentials."] class tech_T1555_003 technique tech_T1552_001["<b>Technique</b> – T1552.001 Credentials In Files: Password Stores<br/><b>Description</b>: Steals Discord tokens, cryptocurrency wallets, SSH keys and API credentials."] class tech_T1552_001 technique %% Connections showing attack flow action_supply_chain –>|delivers| malware_trojanized_server malware_trojanized_server –>|installed by| action_developer_install action_developer_install –>|creates| file_resource_txt file_resource_txt –>|contains| malware_luajit_script malware_luajit_script –>|drops| process_odmw malware_luajit_script –>|drops| process_odmy process_odmw –>|uses| tech_T1053 process_odmy –>|uses| tech_T1053 tech_T1053 –>|creates| process_task_odmw tech_T1053 –>|creates| process_task_odmy process_task_odmw –>|executes| process_odmw process_task_odmy –>|executes| process_odmy process_odmw –>|launches| malware_socket3 process_odmy –>|launches| malware_socket3 malware_socket3 –>|communicates via| tech_T1102 malware_socket3 –>|exfiltrates via| tech_T1041 malware_socket3 –>|deploys| malware_stealc malware_stealc –>|steals| tech_T1555_003 malware_stealc –>|steals| tech_T1552_001 "

Attack Flow

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

  • Attack Narrative & Commands:
    An attacker hosting a counterfeit GitHub repository (e.g., https://github.com/SiddhiBagul/MCP-oura) copies the legitimate SmartLoader payload, re‑brands it, and makes it publicly reachable. A compromised internal host later executes a script that downloads the malicious repository via curl. This action produces an HTTP GET request recorded by the proxy, matching one of the indicator URLs in the rule.

  • Regression Test Script:

    #!/usr/bin/env bash
# SmartLoader fake‑GitHub download simulation – triggers the Sigma rule

MALICIOUS_URLS=(
    "https://github.com/SiddhiBagul/MCP-oura"
    "https://github.com/YuzeHao2023/MCP-oura"
    "https://github.com/punkpeye/MCP-oura"
    "https://github.com/dvlan26/MCP-oura"
    "https://github.com/halamji/MCP-oura"
    "https://github.com/yzhao112/MCP-oura"
)

for url in "${MALICIOUS_URLS[@]}"; do
    echo "[+] Fetching malicious repo: $url"
    # The -L flag follows redirects; -s silences progress; -o discards output.
    curl -s -L -o /dev/null "$url"
done

echo "[+] Simulation complete."

  • Cleanup Commands:

    # No files were persisted, but clear the shell history of the URLs
history -d $(history | grep -n "github.com" | cut -d: -f1)
echo "[+] Cleanup completed – URLs removed from history."

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free