投毒的 Postmark MCP 服务器邮件渗漏 (AML.CS0053)
一句话通俗理解
npm 抢注 + 养信誉 + rugpull：第一个野外恶意 MCP，把企业邮件整批发给后门作者。
案例速览
| 维度 | 内容 |
|---|---|
| 案例类型 | 真实事件 |
| 发生时间 | 2025-09-01 |
| 攻击者 | Unknown Bad Actor |
| 受害目标 | Postmark MCP Server |
| 披露方 | Koi Research |
事件经过
恶意行为者通过供应链攻击渗漏了 Postmark MCP 服务器用户的邮件：攻击者仿冒 Postmark 在 npm 抢注 postmark-mcp 包名，先发布合法版本养信誉，周下载量破千后换成恶意版——经该工具发送的邮件全文被转发至攻击者服务器。这是首个野外恶意 MCP。
运用的 ATLAS 技术
以下攻击链映射来自 MITRE ATLAS 官方数据（AML.CS0053 的
employs关系），按官方步骤编号排序；技术名称链接至本库对应技术文档，引用文字为官方对本次运用的描述。
S00
- 冒充 (AML.T0073)
The bad actor impersonated Postmark by publishing a legitimate version of their
postmark-mcppackage to npm. Postmark had not registered thepostmark-mcpname on npm themselves, allowing the bad actor to namesquat. Legitimate users were tricked into using the npm package even though it wasn’t managed by the official developers ofpostmark-mcp
S01
- 开发能力 (AML.T0017)
The bad actor modified the legitimate Postmark MCP server to include their email address on the BCC line on all emails sent by the tool.
S02
- AI 智能体工具 (AML.T0115.002)
The bad actor published their malicious version of
postmark-mcpto npm.
S03
- AI 供应链拉地毯式撤离 (AML.T0109)
By waiting for users to adopt a legitimate version of
postmark-mcpfirst, the bad actor was able to evade the additional scrutiny and scanning performed on new tools.
S04
- AI 智能体工具 (AML.T0010.005)
When organizations upgraded
postmark-mcpto version1.0.16, they received the malicious version of the tool via the compromised supply chain.
S05
- 实现 (AML.T0110.001)
Once configured with the organization’s AI agents, the poisoned Postmark MCP server’s effects persist.
S06
- 投毒 AI 智能体工具 (AML.T0011.002)
When users at the victim organization instructed their AI agent to use tools provided by the poisoned Postmark MCP Server, the malicious code was executed.
S07
- 通过 AI 智能体工具调用渗漏 (AML.T0086)
When organizations sent emails via the
postmark-mcptool, the entire contents of their emails are exfiltrated to the bad actor via the address added on the BCC line.
S08
- 外部危害 (AML.T0048)
The exfiltrated emails may include transactional emails (revealing private information about the organization’s clients) and promotional emails (revealing the organization’s client list).
关联战术
- 防御规避 (AML.TA0007)
- 资源开发 (AML.TA0003)
- 初始访问 (AML.TA0004)
- 持久化 (AML.TA0006)
- 执行 (AML.TA0005)
- 数据渗漏 (AML.TA0010)
- 影响 (AML.TA0011)
参考资料
以下为 MITRE ATLAS 官方案例收录的参考来源：
版本: ATLAS 2026.09 | 更新: 2026-10-24 | 模板: ATLAS 案例研究 v1.0