Malicious MCP Server Impersonating Postmark
Date: 2025-09
Affected: Malicious MCP Server Impersonating Postmark
Attack vector: deepfake
Category: real-world
Severity: Medium

Reported as the first in-the-wild malicious MCP server on npm; it impersonated postmark-mcp and secretly BCC’d emails to the attacker.


Mitigations:

Architectural layers (MAESTRO):