HasData Airbnb MCP Credential Relay

How the attack works

An AI agent uses the hasdata-airbnb-mcp package to send a listing or search query to HasData's Airbnb scraping endpoint, which is normal, expected behavior. A compromised or typosquatted version of that package piggybacks extra data onto the same outbound request: things like AWS keys, GitHub tokens, SSH keys, Slack tokens, or the contents of local secret files. Alternatively it may attach an attacker-controlled callback or webhook URL to the request so stolen data or beacon signals go somewhere the attacker controls. Because it rides inside a request that also contains legitimate Airbnb-scraping markers, it looks like normal traffic unless someone checks the payload contents. The rule catches this single request pattern, not the initial compromise of the package itself.

Netzilo detection

Why it matters

If exploited, an organization's cloud credentials, SSH keys, API tokens, or other local secrets could be exfiltrated silently through what looks like a routine scraping API call, and the attacker could also establish a covert callback channel — all without any visible sign that the package itself was tampered with.

What you can do

• →Pin and verify the exact version and hash of hasdata-airbnb-mcp you install; do not auto-upgrade MCP server packages.
• →Restrict outbound network access for AI agents to only the specific endpoints they need, blocking arbitrary callback/webhook destinations.
• →Audit where secrets like AWS keys, SSH keys, and API tokens are stored and ensure agent processes cannot read them (avoid mounting ~/.aws, ~/.ssh, .kube/config, or /proc/self/environ into agent environments).
• →Review outbound HTTP logs from any MCP integration for unexpected credential-shaped strings or unfamiliar URL parameters, even when the destination looks legitimate.

Known benign look-alikes

• An agent fetching the package's PyPI project page or GitHub README, where the usage example shows an API key literal next to the package name. Suppressed by filter_placeholders (YOUR_API_KEY, <api_key>, sk-example) and filter_docs (fenced code block plus a pip install line).
• Developer test suites and recorded HTTP fixtures for hasdata-airbnb-mcp that embed mock credentials. Suppressed by filter_test_fixture.
• A user's genuine HasData service key that happens to match a generic secret shape. HasData keys are not sk-/AKIA/ghp_ prefixed, so sel_cred should not match them; if a deployment issues keys in one of those formats this rule will report on every call from that deployment and sel_cred must be tightened.
• A legitimate integration that intentionally posts a callback_url to receive async scrape results. This is a supported pattern for some scraping APIs; if it is in use here, sel_exfil_param will report on normal traffic and should be dropped from the condition rather than the destination being allowlisted.
• Debug or error payloads that echo the agent's environment (os.environ dumps in a stack trace) attached to an outbound request. Genuinely worth reviewing, but it is operator error rather than package compromise.

References

• https://attack.mitre.org/techniques/T1195/002/
• https://attack.mitre.org/techniques/T1567/
• https://attack.mitre.org/techniques/T1552/001/

Related threats