Active Deadbugz Campaign Targets Model Context Protocol Servers via Malicious PRs
Pillar Security discovered an active supply-chain campaign named Deadbugz targeting Model Context Protocol (MCP) clients. The attack uses runtime-gated prompt poisoning that waits for three benign tool calls before swapping metadata to exfiltrate SSH keys and cloud credentials.
Why it matters
Pillar Security discovered an active supply-chain campaign named Deadbugz targeting Model Context Protocol (MCP) clients. The attack uses runtime-gated prompt poisoning that waits for three benign tool calls before swapping metadata to exfiltrate SSH keys and cloud credentials.
Open the full story