SmartLoader hackers clone Oura MCP project to spread StealC malware

Hackers used a fake Oura MCP server to trick users into downloading malware that installs the StealC info-stealer.

Security Affairs

#SmartLoader #IoC

* Launcher.cmd - `bfa702a87c14dc0b6f4bc213443749bd`
* AhnLab-V3: `Infostealer/CMD.RunLua`:2026.01.26.03
* libgcc.txt - `aaac548d0666c5e8496e52213f8d48cb`
* AhnLab-V3: `Infostealer/Script.RunLua.SC300406`:2026.01.26.03
* ViRobot: `Script.S.Agent.359842`