Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A blockchain developer in Russia lost $500,000 in crypto assets due to a malicious Solidity Language extension for Cursor AI IDE. The fake extension, downloaded 54,000 times, appeared higher in search results than the legitimate one due to ranking algorithms. It installed malware that allowed remote access and data theft. The attackers used ScreenConnect for remote control and deployed various scripts to steal wallet passphrases. A new malicious package was published shortly after the first was removed, with an inflated download count of 2 million. Similar attacks were found targeting blockchain developers through other extensions and npm packages. The incident highlights the ongoing threat of malicious open-source packages in the crypto industry.

This threat involves a malicious open-source package masquerading as a legitimate Solidity Language extension for the Cursor AI Integrated Development Environment (IDE), which is widely used by blockchain developers for smart contract development. The malicious extension was downloaded approximately 54,000 times initially and ranked higher than the legitimate extension due to search algorithm manipulation. Once installed, it deployed malware that enabled remote access to the victim's system using ScreenConnect, a legitimate remote administration tool often abused by attackers. The malware executed various scripts designed to steal sensitive data, specifically targeting wallet passphrases and other credentials related to cryptocurrency assets. After the initial malicious package was removed, attackers quickly published a new malicious package with an inflated download count of 2 million to continue the campaign. Similar attacks have been observed targeting blockchain developers through other extensions and npm packages, indicating a broader campaign exploiting the trust in open-source software repositories. The attack leverages multiple tactics including malware installation, remote access, credential theft, and social engineering through search ranking manipulation. The use of ScreenConnect and scripts for data exfiltration aligns with known adversary techniques such as credential dumping (T1555), input capture (T1056.001), and persistence mechanisms (T1547.001). This incident underscores the persistent risk posed by malicious open-source packages in the cryptocurrency and blockchain development ecosystem, where compromised developer tools can lead to significant financial losses.

Detailed information about The Solidity Language open-source package was used in a $500,000 crypto heist. Get real-time updates, technical details, and mitigati

The Solidity Language open-source package was used in a $500,000 crypto heist - Live Threat Intelligence - Threat Radar | OffSeq.com

The Solidity Language open-source package was used in a $500,000 crypto heist

Threats Tagged 'cursor ai'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cursor ai'

Lead Pen Test Professional