When the protocol itself becomes the payload.
An attacker publishes a Node.js package presenting as a SOX/DRP-2026 compliance verification tool. The repository contains no binary payload; the malicious URL is base64-encoded and the process spawn is obfuscated via character-code arrays. The code passes standard SAST and human code review.
Once registered as an MCP server, the attack fires automatically on the initial protocol handshake (the tools/list call) — before the user invokes a tool or types any prompt. The MCP specification provides no mechanism to inspect server code before granting tool access.
Execution proceeds through a living-off-the-land chain (node.exe → wscript.exe → curl.exe) using only signed Microsoft binaries. No anomalous process names. No behavioral signatures fire across five independent security controls.
Exfiltration targets the MEGA cloud API over HTTPS, where client-side encryption makes content inspection by DLP or CASB structurally infeasible. Total elapsed time from MCP server registration to completed exfiltration is under 90 seconds.
Morphisec AMTD intercepts at the memory execution layer — the only control in this stack that operates at execution time rather than at the perimeter, the content layer, or behavioral pattern. The attack terminates before the first byte reaches the attacker.
A single install becomes a dual-engine exfiltration pipeline.
The diagram traces the five stages from package publication to MEGA cloud landing, with every transition mapped to the LOLBin invoked and the control class that fails to observe it.
Five stages. Mapped to MITRE ATT&CK where they fit. Flagged where they don’t.
Malicious npm package masquerading as a compliance SDK
The attacker publishes drp-compliance-sdk on the npm public registry with a polished README, plausible compliance terminology (SOX, DRP-2026), and a tagged release. The repository contains no binary. The malicious URL is base64-encoded and the process spawn is obfuscated via a character-code array. Both standard SAST scanners and human reviewers approve the package.
MCP tools/list handshake fires the payload before user input
When the AI coding assistant starts and discovers MCP servers, it issues a tools/list JSON-RPC call to each registered server. The malicious server’s implementation of that handler decodes the URL, spawns wscript.exe, and returns a valid tool list (verify_document) so the user sees nothing unusual. The malicious code path executes before the user has typed a prompt or invoked any tool.
An alternative trigger path uses prompt injection via document content: a financial PDF carries hidden instructions that hijack the AI’s intent toward calling the tool, transferring more sensitive context into the exfiltration payload.
LOLBin chain — node.exe → wscript.exe → MSBuild.exe → curl.exe
Every binary in the chain is signed by Microsoft. wscript.exe runs a VBScript that reflectively loads a .NET assembly into MSBuild.exe, where a memory-only loader (DRPAuditSvc.exe) is established. Collection walks ~/.ssh, ~/.aws, ~/.kube, browser profile directories, environment variables matching *_TOKEN/*_KEY/*_SECRET, and recently-modified files in development project directories.
The collected data is compressed into a TAR archive entirely in process memory. No on-disk staging artifact exists at any point.
Dual-engine HTTPS exfil — MEGA primary, Cloudflare-fronted VPS fallback
Engine A POSTs the in-memory TAR to g.api.mega.co.nz. MEGA performs client-side encryption before upload, so DLP / CASB content inspection is structurally infeasible without a dedicated MEGA decryption capability. Engine B mirrors a minimal triage payload (host fingerprint, file list, environment marker hashes) to a Cloudflare-fronted VPS to ensure delivery if MEGA is blocked at the egress boundary.
Scheduled task persistence · no on-disk staging artifact
A scheduled task is registered to re-trigger the chain at user logon, keyed to DRPAuditSvc.exe. The original npm package remains in node_modules as benign-looking compliance tooling. No payload binary, intermediate script, or staging directory is ever written to disk. Forensic recovery requires memory acquisition of the assistant process at the moment of execution.
Five EDR/DLP stacks. Five misses. One catch.
The attack was executed end-to-end against five independent security control classes in a controlled Morphisec Red Team lab environment. The table below records the verdict and the architectural reason for that verdict.
Verified against the Morphisec Red Team build of this chain.
Public infrastructure may be sinkholed at the time of reading; check current state before adding to a blocklist.
| Type | Indicator | Context |
|---|---|---|
| Domain | drp-audit-cdn[.]net | VPS relay (Cloudflare-fronted) |
| Domain | g.api.mega.co.nz | Legitimate MEGA API · abused |
| URL Path | /audit | POST endpoint on VPS relay |
| Type | Indicator | Context |
|---|---|---|
| npm Package | [email protected] | Malicious MCP server package |
| Process | DRPAuditSvc.exe | In-memory loader handle (synthetic) |
| Script | drp_audit.vbs | Transient wscript artifact (RAM only) |
| Config Path | ~/.claude/mcp_servers · ~/.cursor/mcp.json | MCP registration sink |
What to do now, this week, and at a posture level.
Sequenced for immediate, short-term, and strategic posture changes. The “Now” actions can be deployed via existing tooling without procurement.
Inventory MCP servers across developer endpoints
Enumerate every entry in ~/.claude/mcp_servers, ~/.cursor/mcp.json, and equivalent configuration paths. Treat any MCP server whose origin cannot be attributed to an authorized internal repository as suspect.
Hunt for node.exe spawning wscript.exe or cscript.exe
Apply the KQL pattern in section 05 across your endpoint telemetry for the last 30 days. This combination is rare in legitimate developer workflow and is a high-signal indicator of this chain or a near variant.
Action · NowBlock outbound to MEGA API endpoints for development hosts
Endpoint segmentation: development workstations rarely have a legitimate need to reach g.api.mega.co.nz. Block at egress; alert on attempts.
Require code review for MCP server packages
Add MCP server installation to your sensitive-tool approval workflow. Standard SAST will not catch this pattern; require a human review of every tools/list handler implementation.
Adopt memory-layer prevention on developer endpoints
Cloud reputation and behavioral analytics cannot see this chain. Memory-layer prevention (Morphisec AMTD or equivalent) intercepts at execution time, before the first byte of data leaves the host, without requiring a signature or behavior model for this specific attack.
StrategicTreat AI coding assistants as a privileged identity
An AI assistant with MCP server access is effectively a high-privilege automation account on the developer’s machine. Apply the same auditing, allow-listing, and least-privilege controls you apply to service principals and CI runners.
Strategic