Unverified50% confidenceEventExact time
安全研究人员发现一个恶意MCP服务器伪装成正规邮件转发服务Postmark MCP，实际会在每封邮件密送一份给攻击者
1
Sources
50%
Confidence
Long-term
Relevance
7/20/2026
First Seen
Sources
Related Claims
VerifiedMCP tools are essentially arbitrary code execution, indirect prompt injection is a real-world threat, and attack vectors can be hidden in resource content rather than in direct user input.69% similarUnverified当前MCP生态缺乏类似App Store审核机制的准入管控，安全研究人员已发现多个MCP投毒攻击案例，包括Typosquatting钓鱼攻击和伪装成Postmark MCP的恶意服务器69% similarUnverifiedMCP supports progress notification and log feedback mechanisms, allowing an MCP Server to proactively return execution progress and real-time logs to the client during tool execution.68% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/573096API
curl https://kongchang.com/api/v1/knowledge/claims/573096MCP
get_claim(id=573096)