In September 2025, attackers promoted a counterfeit model context protocol (MCP) server mimicking technology to integrate Postmark, an email service owned by ActiveCampaign, into AI assistants. The fake MCP server package looked legitimate and functioned across 15 versions before a single-line code change was introduced.
The vulnerability or weakness
The vulnerability lay in the lack of central MCP authority verifying server identity and the absence of a cryptographic link between an MCP server and the organization it claimed to represent.
Earlier attacks and coverage
No earlier related attack in our archive yet.
Business impact
This attack exposed enterprises relying on the tool to a form of supply chain attack, potentially leading to the silent siphoning of sensitive communications such as password resets, invoices, and internal memos for days before detection, impacting operations and potentially legal and reputational standing.
Industries affected
The attack could affect any industry that relies on transactional email services and AI assistants.
Users affected
Users and customers of Postmark and any organization that integrates AI assistants with email services were potentially affected, with their sensitive communications at risk of unauthorized access.
