Cybersecurity researchers have uncovered a critical “by design” vulnerability in Anthropic’s Model Context Protocol (MCP) architecture that enables Arbitrary Command Execution across the AI supply chain. Currently lacking a centralized CVE-ID (though spawning multiple downstream CVEs), this systemic flaw remains unpatched by Anthropic, leaving over 150 million downloads and 200,000 instances at risk of complete server takeover.
Vulnerability Details
Affected Product: Anthropic Model Context Protocol (MCP) SDKs and downstream integrations (All versions)
Attack Vector: Attackers inject malicious OS commands via the MCP STDIO interface using malformed JSON configurations, which the server executes as a subprocess without sanitization.
Ease of Exploit: High - Requires no authentication in many exposed UI configurations, allowing direct command execution.
Action Plan
Immediate Action: Implement strict input sanitization for all external MCP configurations, as Anthropic will not release a Version patch for this “expected behavior”.
Workaround: Block public IP access to sensitive MCP services, run MCP-enabled services in isolated sandboxes, and enforce strict allowlists for commands.
Detection: Monitor and audit all MCP tool invocations and STDIO process spawns for anomalous or unauthorized OS commands.
Relevant professional terms
Model Context Protocol (MCP)
An open standard introduced by Anthropic that provides a universal connector between AI agents and external data sources or tools, increasingly adopted across the AI ecosystem.
Arbitrary Command Execution
A vulnerability that allows an attacker to run any operating system command on a target server, often leading to full system compromise, data theft, or lateral movement.
Cloud platform Vercel confirmed a security breach after threat actors compromised a third-party AI integration. The incident exposed internal systems and customer credentials, highlighting severe supply chain risks.
Attack Overview
Attack Path: Attackers compromised Context.ai, abusing its Google Workspace OAuth app to hijack a Vercel employee’s account and access internal environments.
Attacker:ShinyHunters
Impact Assessment
Data Stolen:580 employee records, source code, databases, and deployment credentials (NPM/GitHub tokens).
Operational Impact: Non-sensitive environment variables were exposed, forcing a subset of customers to rotate credentials.
Threat actors are distributing the FakeWallet crypto stealer via over twenty phishing apps masquerading as legitimate cryptocurrency wallets in the Apple App Store. The campaign primarily targets Chinese iOS users to hijack recovery phrases and private keys.
Key TTPs
Initial Access: Distribution of trojanized crypto wallets via the official Apple App Store using typosquatting.
Execution: Malicious modules scan the app’s view controller to extract, encrypt (RSA), and exfiltrate seed phrases.
Defense Evasion: Apps use functional stubs (games, calculators) to appear authentic and bypass App Store filters.
Campaign Analysis
Active since fall 2025, this campaign exploits regional restrictions on official crypto apps in China. It highlights a significant risk by successfully bypassing Apple’s stringent review process.
Targeting & Infrastructure
Target Profile: iOS users in China seeking popular cryptocurrency wallets like MetaMask and Ledger.
Infrastructure: Phishing pages mimicking the App Store and C2 servers receiving Base64-encoded mnemonics.
Relevant Terms
Typosquatting: Registering names similar to popular brands to deceive users into downloading fake software.
Mnemonics: A secret seed phrase of words storing the information needed to recover cryptocurrency funds.
Adversaries are exploiting legitimate Apple account change notifications to deliver highly convincing fake iPhone purchase scams. By injecting malicious text into account profile fields, attackers leverage Apple’s trusted infrastructure to bypass spam filters.
Key TTPs
Initial Access: Attackers modify Apple ID profile fields to trigger legitimate security alerts containing embedded phishing lures.
Execution: Social engineering tactics create urgency, prompting victims to call a fraudulent support number.
Defense Evasion: Emails originate from Apple’s official servers, successfully passing SPF, DKIM, and DMARC checks.
Campaign Analysis
This campaign highlights a growing trend of abusing legitimate cloud infrastructure to bypass traditional email security gateways. The enhanced legitimacy of the lures significantly increases the risk of financial fraud.
Targeting & Infrastructure
Target Profile: General Apple account users.
Infrastructure: Attackers abuse Apple’s native email notification system and iCloud accounts to route malicious messages.
Relevant Terms
Spearphishing: A highly targeted cyber attack that uses deceptive emails to trick specific individuals into revealing sensitive information.
DKIM: An email security standard designed to ensure messages are not altered in transit between the sending and receiving servers.
Darktrace researchers discovered ZionSiphon, an OT-focused malware designed to sabotage Israeli water treatment and desalination plants. The politically motivated threat aims to manipulate hydraulic pressure and chlorine levels to cause physical damage.
Key TTPs
Initial Access: Spreads via removable media (USB drives).
Execution: Uses PowerShell for privilege escalation and interacts with OT devices via Modbus, DNP3, and S7comm.
Defense Evasion: Masquerades as svchost.exe to blend with normal system activity.
Campaign Analysis
Although currently non-operational due to a coding flaw, ZionSiphon highlights a dangerous shift toward politically motivated cyber-physical attacks. It demonstrates that OT-specific sabotage capabilities are no longer exclusive to top-tier nation-states.
Targeting & Infrastructure
Target Profile: Israeli water treatment and desalination facilities.
Infrastructure: Hardcoded Israeli IPv4 ranges.
Actionable Intelligence
IPs:2.52.0.0/14, 79.176.0.0/12, 212.150.0.0/16
Relevant Terms
Operational Technology (OT): Hardware and software used to monitor and control physical industrial processes.
Modbus: A standard industrial communication protocol used to transmit data between electronic devices.
