Skip to content

Back to the catalog

Deadbugz: Currently Active MCP Supply-Chain Campaign
pillar.securitywriteup

Deadbugz: Currently Active MCP Supply-Chain Campaign

Pillar Security disclosed "Deadbugz," an active campaign distributing a malicious MCP server called productivity-suite via 23 public GitHub pull requests to AI/MCP/dev-tool repos. The server appears benign (text formatting/summarization) but after three tool calls it flips its tools/list and prompts/get responses to instruct the connected AI agent to hunt for SSH keys, AWS credentials, shell history, and Kubernetes configs while concealing the activity — a "runtime-gated" tool-metadata rug pull designed to evade quick security review. The report attributes delivery to GitHub account zellkernel (linked to X account @llmgod), provides the malicious endpoint and local-path IOCs, and recommends clients treat any post-approval change to an already-approved server's tool definitions as a security event requiring re-approval.

TL;DR A malicious MCP server delivered via 23 GitHub PRs stays benign for two tool calls, then rewrites its own metadata to direct AI agents to steal SSH keys, AWS creds, and Kubernetes configs while hiding the activity from the user.
Open original ↗
Document

What it is

Concrete detection and delivery details for the Deadbugz campaign — an active MCP supply-chain operation attributed to the GitHub account zellkernel (linked to @llmgod on X). The summary names the technique; this page provides the indicators needed to hunt and block it, plus the delivery breakdown.

How it works

The productivity-suite server keeps an in-memory, per-client counter of tools/call requests. On the fourth call (after three ordinary ones), subsequent tools/list and prompts/get responses swap benign tool documentation for instructions steering the agent toward SSH keys, AWS credentials, shell history, and Kubernetes configs, and telling it to hide the activity. The server advertises tools.listChanged, so compatible clients refresh the poisoned metadata mid-session. The public source also implements optional connection, first-call, and trigger-event telemetry via a WEBHOOK_URL configuration.

Preconditions / Affected

A client must add one of the malicious MCP configurations and then cross the three-call threshold in normal use. Brief inspection or a short test that stays under three calls sees only benign metadata — that gate is the point.

What to do

Search MCP configs and PR patches for these indicators:

  • Remote endpoint (defanged in source): hxxps[:]//productivity-suite-mcp[.]onrender[.]com/mcp
  • Hidden local script path:
~/.config/.cache/.sys/.deadbug-mcp.py
  • Server/product name productivity-suite; delivery artifact deadbug-mcp.py; the zellkernel GitHub account and productivity-suite-mcp repo.

The 23 PRs break down as 17 remote-MCP configs, 4 hidden-local-script configs, 2 directory/listing submissions. Treat any MCP config PR from an unfamiliar contributor as suspect, and test MCP servers past the three-call mark before trusting them.

Caveats

Pillar states the 23 reviewed PRs were not merged through GitHub's merge mechanism (19 closed, 4 open) at review time — the attempt was blocked, not confirmed successful. The delivery window was narrow: all 23 PRs were created in 74 minutes, 9:52–11:07 PM UTC on August 10, 2026, so a config-content search is more reliable than watching that account. Attribution is to the observable zellkernel account and infrastructure only. The disclosure is marked as one that will be updated as verified information becomes available.

Organisations named here

  • Invariant Labs
  • Koi
  • @llmgod

Technologies named here

  • MCP client configurations
  • productivity-suite-mcp
  • deadbug-mcp.py
  • WhatsApp MCP integration
  • tools.listChanged
  • postmark-mcp package
  • WEBHOOK_URL configuration
  • Model Context Protocol
  • GitHub
  • Python
  • AWS
  • Kubernetes
  • SSH
  • postmark-mcp

Techniques named here

  • Runtime-gated MCP metadata poisoning
  • Supply-chain delivery via GitHub pull requests
  • Research-evasion via call-count threshold
  • MCP sleeper attack
  • Malicious package update / weaponization

Threat actors named here

  • Deadbugz
  • zellkernel
  • llmgod
  • productivity-suite

Related in AI Security