Fake 'Blender MCP' Addon Dropped StealC Infostealer the Moment You Enabled It

A fake Blender AI addon discovered on GitHub this week shows how far malware authors will go to ride the Model Context Protocol (MCP) wave: clone a beloved open-source project, dress the copy in a professional README with an MIT badge and SEO keywords, and — per a researcher’s code teardown — silently drop a known infostealer the moment the victim ticks the enable checkbox in Blender.

On October 18, security researcher vibelancer published a detailed teardown on X of LiCinCan/blender-ai-mcp-addon, a repository selling itself as “mcp-for-blender-pro”: a visual chat workspace, 21 scene tools, manager/worker/reviewer agent chains, and connections for OpenAI, Claude, Gemini, Ollama and OpenCode. The repo’s README is polished — capability tables, install instructions, a keyword list roughly 40 entries long — and at reporting time the repo showed 791 stars and 300 watchers.

The problem is what shipped inside the zip.

What the teardown found

According to vibelancer’s analysis, the addon’s register() function called a run_embedded() routine as soon as the user enabled it in Blender’s preferences — no further clicks, no prompts. That routine booted an embedded Python 3.13 runtime (pythonw.exe, 41 files) bundled under tools/python-x64, which nothing in the visible chat or MCP code path actually used.

The payload’s carrier was unusual: blen.blend, a 390 KB file posing as a 3D scene, sitting inside the Python folder. The researcher says it carried a 2,615-character text block that was decrypted via base64 decoding and an XOR stream keyed by a SHA-256 digest, then executed with CREATE_NO_WINDOW so nothing appeared on screen. The decrypted first stage paused 1.1–3.4 seconds, then contacted https://193.104.58.41:8443 — a bare IP, TLS certificate verification disabled, and a spoofed Chrome 130 user agent.

The second stage requested a file called mod-stealc.py and executed it in memory. StealC is a known infostealer family that targets browser passwords, cookies and cryptocurrency wallets. A guard file, %TEMP%\hjaksdhk1242kjha.txt, ensured the payload ran once and then stayed quiet, keeping the infected machine looking normal.

A one-letter-off impersonation

The cover story is where the campaign got clever. Per the teardown, roughly 3,651 lines were copied from the real blender-mcp by ahujasid — a genuine, widely used community project (31.6k stars, 246 commits, 3.0k forks) that connects Blender to LLMs and recently renamed its PyPI package to mcp-for-blender. The fake’s manifest listed its maintainer as “anujasid” — one letter off from the real author. Each individual component looked like a normal addon: a borrowed codebase, a standard embedded runtime, a scene file. Assembled, they formed a dropper with a chat UI.

The technique matters because it weaponizes exactly the trust heuristic most people use. “Most people check the screenshots and hit install,” vibelancer wrote. “The code is where it gets interesting.” A README with capability tables, model logos and agent workflow diagrams reads as competence; nothing about it invites a line-by-line audit. And an addon that asks you to paste API keys for OpenAI, Anthropic or Google hands the operator both an infostealer payload and live credentials in one install.

Why MCP is the new delivery vehicle

The researcher’s framing is the part operators should internalize: “the novelty is not AI in Blender. the novelty is stealers now shipping as MCP servers, because that’s what people install without reading.”

The agentic-tooling boom has trained users to bolt MCP servers, plugins and addons onto their working environments at a rapid clip. Each install is an implicit grant of local code execution — and frequently of stored credentials. That’s the same dynamic we covered in Shadow MCP Is the New Shadow IT and in MCP marketplace security after MCPJacking and Plugin4Shell: the trust boundary between “tool I configured” and “arbitrary code on my machine” has effectively dissolved. This incident is that abstract risk rendered concrete — an infostealer operation specifically packaging itself in the shape agents users install on trust.

A few practical conclusions:

Signal	What to check	What the fake did
Maintainer identity	Compare against the canonical repo’s owner	“anujasid” vs. real author ahujasid — one letter off
Repo history	Commits, releases, contributors, issue activity	A single commit, no releases, no contributor history
Bundled runtime	Does the code need an embedded Python?	Full hidden Python 3.13 unused by visible features
Network behavior	Any hardcoded IPs or disabled TLS checks	Bare IP 193.104.58.41:8443, verification off

None of these checks is sophisticated; the point is that nobody runs them on an addon that looks like every other addon. Treat any repo as an intake problem — the same discipline we recommended in GitSpawn week: untrusted repos are an intake problem — keep a weekly MCP server inventory so you know what’s actually installed, and apply the government-guidance-era controls from Hardening MCP in Production to every server that touches credentials.

If you installed it

The researcher’s guidance: disable and delete the addon, check for %TEMP%\hjaksdhk1242kjha.txt, rotate every API key you pasted into it, change browser passwords from a clean device, and move funds out of any hot wallet on that machine. That last item is not paranoia — StealC’s core targets are browser passwords, cookies and crypto wallets, and anything the addon could read should be considered taken. The same rotate-cap-audit discipline applies to any key that touched the machine.

When we last checked on October 19, the repository was still public, still accumulating stars, and showing no flag or takedown banner. GitHub will eventually catch repos like this one, but takedown is not prevention. The window between “published” and “removed” — with a well-SEO’d README and a stolen codebase doing their work the whole time — is exactly the gap that matters. The defense isn’t faster platform moderation; it’s slower installs.

Load X post

Loading this post connects to X.

The original source is available above.