Unverified50% confidenceFactExact time
The malicious MCP server disguised itself as an email-sending server with the same name as an official one, functioned normally, but secretly BCC'd every email to a third party.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/10/2026
First Seen
Valid until: 1/8/2027
Sources
Related Entities
Related Claims
UnverifiedGoose grants trust by default to MCP servers manually added by users, so a write tool falsely labeled as read-only will be executed directly without any confirmation.72% similarUnverifiedIn September 2025, a backdoored Postmark MCP server was disclosed that silently BCC'd outgoing emails to the maintainer.71% similarUnverified邮件转发中Received字段记录每一跳服务器信息，Return-Path字段存储退信地址，X-Forwarded-To等扩展头字段可能暴露真实收件人67% similarUnverified邮箱别名服务（如SimpleLogin、Apple Hide My Email、DuckDuckGo Email Protection）为每个网站生成独立转发地址，邮件经服务商中转后送达真实邮箱67% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/994101API
curl https://kongchang.com/api/v1/knowledge/claims/994101MCP
get_claim(id=994101)