Loading story…
Researchers reported that the NadMesh botnet is actively targeting exposed AI platforms and administrative services to steal cloud credentials, Kubernetes tokens, model access, and callable Model Context Protocol (MCP) tools. The Go-based malware, first observed in early July, scans for services including ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio, while also exploiting exposed Docker APIs, Jenkins script consoles, Redis, Telnet, Kubernetes, Elasticsearch, Airflow, Superset, WebLogic, and other weakly secured systems. QiAnXin XLab said the operation uses a productized architecture with a controller, web panel, adaptive tasking, polymorphic builds, and persistence via SSH authorized_keys, hidden binaries, and cron watchdogs; published indicators include C2 IP 209.99.186[.]235, domain cdnorigin[.]net, and sample SHA1 31c69b3e12936abca770d430066f379ec1d997ec.
The campaign is exploiting a broader security gap around Internet-exposed MCP deployments, which Censys said numbered 12,520 accessible services across 8,758 IPs in 56 countries, with most running protocol version 2025-03-26. The MCP specification does not require authentication or authorization by default, and Censys found many exposed servers advertising sensitive capabilities such as database access, system control, enterprise integrations, and command-execution-style tools. Researchers cautioned that even authenticated MCP deployments remain at risk from abuse through trusted AI integrations, making exposed MCP infrastructure an attractive target for operators like NadMesh seeking data disclosure, unauthorized access, and downstream cloud compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
According to The Hacker News' summary of XLab findings, XLab telemetry recorded a sharp rise in distinct source IPs distributing NadMesh to about 139 per day in early July, indicating growing botnet activity.
On 2026-07-17, QiAnXin XLab published a technical analysis of NadMesh, describing its architecture, exploitation vectors, persistence mechanisms, and indicators including C2 IP 209.99.186[.]235, domain cdnorigin[.]net, and a malware sample SHA1.
QiAnXin XLab reported that the Go-based NadMesh botnet was observed in early July 2026, combining scanning, exploitation, credential theft, and AI-service intelligence harvesting in a platform aimed at AI infrastructure and MCP-related services.
As of 2026-04-28, Censys identified 12,520 accessible MCP services across 8,758 unique IP addresses in 56 countries, highlighting broad public exposure of MCP deployments and risky capabilities such as database access and system control.
The Model Context Protocol authorization specification referenced in the materials is versioned 2025-03-26, indicating that this specification revision was published on that date.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecyberaccord.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourceblog.xlab.qianxin.com
Open sourceblog.xlab.qianxin.com
Open sourcecensys.com
Open sourcemodelcontextprotocol.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Internet-wide reconnaissance is actively probing exposed AI infrastructure, with analysts observing systematic scans for **Model Context Protocol (MCP)** servers, AI assistant credential files, and unauthenticated model-serving endpoints. Over a two-week period, Apache and ModSecurity logs from a small web host recorded roughly 200 AI-related requests, including valid JSON-RPC 2.0 `initialize` handshakes sent to MCP services from 49 source IP addresses. The activity also searched for configuration and credential artifacts tied to tools such as **Claude** and **Cursor**, alongside checks for OpenAI-compatible `/v1/models` and Ollama `/api/tags` endpoints. The probing went beyond simple path enumeration and showed attackers understand the targeted protocols and deployment patterns, suggesting opportunistic discovery of vulnerable AI environments at scale. The same activity included SSRF-style requests aimed at cloud metadata services and Kubernetes token locations, raising the risk that exposed agent tooling, MCP servers, or URL-fetching features could be abused to steal secrets, obtain cloud credentials, or pivot deeper into internal environments. Defenders were urged to review logs for MCP-related traffic, limit public exposure of AI services, secure assistant configuration files, harden fetch capabilities, and enforce metadata protections such as **AWS IMDSv2** and required GCP metadata headers.
Jul 13, 2026
Security reporting and research warned that the **Model Context Protocol (MCP)** has opened a new attack surface for enterprise AI agents, allowing malicious content delivered through context windows, documentation, support tickets, GitHub issues, or untrusted MCP servers to trigger unauthorized actions without compromising the underlying model. Reported examples included WhatsApp data exfiltration, leakage of private repository data, abuse of a Supabase Cursor agent through crafted support tickets, and **`CVE-2025-6514`**, a high-severity OS command-injection flaw that could enable remote code execution via untrusted MCP servers. A separate proof-of-concept targeting Andrew Ng’s **Context Hub** showed how poisoned API documentation served through an MCP server could silently steer coding agents into adding fake or malicious dependencies to generated projects, highlighting a software supply-chain risk in community-authored documentation pipelines. Across the coverage, researchers and vendors said perimeter controls and AI gateways are not enough because attackers or insiders can interact directly with MCP services; they urged organizations to treat MCP connectivity as privileged access, sanitize all context inputs, enforce policy and approval checks at the MCP server, restrict agent network and data access, and adopt zero-trust execution controls with auditable action receipts.
Jul 23, 2026
Researchers at **OX Security** disclosed a design-level weakness in Anthropic’s **Model Context Protocol (MCP)** that can allow **arbitrary OS command execution** through unsafe `STDIO` transport behavior, creating a broad AI supply-chain risk. The flaw is reported to propagate through Anthropic’s official MCP SDKs into downstream tools and agents, with researchers linking it to at least **10 high- and critical-severity vulnerabilities** across widely used projects. Reported impacts include exposure of sensitive data such as API keys, chat histories, internal databases, and developer workstations, while estimates of exposure range from more than **7,000 publicly accessible servers** to as many as **200,000 servers** potentially at risk. Affected or cited projects include **LangFlow, Flowise, GPT Researcher, Upsonic, Windsurf, Claude Code, Cursor, Gemini-CLI, GitHub Copilot, LiteLLM,** and **LettaAI**. OX Security said it began reporting the issue to Anthropic in late 2025, but Anthropic reportedly treated the behavior as expected and responded by updating security guidance rather than changing the protocol architecture. Researchers described four main abuse paths: direct command injection, hardening bypass, zero-click or near-zero-click prompt injection in AI IDEs and coding assistants, and malicious MCP marketplace submissions that can execute commands on developer machines; they urged organizations to restrict public exposure, sandbox MCP-enabled services, treat external MCP configurations as untrusted, monitor MCP tool use, and install MCP servers only from verified sources.
Jun 29, 2026