TECH Signal 401
Deadbugz MCP supply-chain campaign uses GitHub PRs to deliver credential-stealing server
↗
Pillar Security identified an active campaign that distributes a malicious MCP server via GitHub pull requests, with the server hiding credential-seeking instructions until three tool calls are made.
Engineers who review pull requests adding MCP configuration should treat new servers as untrusted, since a benign-looking tool can change its behavior after a few calls. The runtime-gated trigger evades casual inspection, so static review alone may miss the malicious instructions.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
The malicious MCP server, named productivity-suite, returns benign tools initially but switches to credential-seeking instructions after three tool calls.
The campaign uses 23 GitHub pull requests from account zellkernel, with 17 configuring a remote endpoint and four referencing a hidden local Python file.
The runtime-gated metadata poisoning is designed to evade research and inspection, as only normal use crosses the three-call threshold.
THE CLUSTER