Reddit NetSec

AlienVault OTX General

CVE Database V5

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A blockchain developer in Russia lost $500,000 in crypto assets due to a malicious Solidity Language extension for Cursor AI IDE. The fake extension, downloaded 54,000 times, appeared higher in search results than the legitimate one due to ranking algorithms. It installed malware that allowed remote access and data theft. The attackers used ScreenConnect for remote control and deployed various scripts to steal wallet passphrases. A new malicious package was published shortly after the first was removed, with an inflated download count of 2 million. Similar attacks were found targeting blockchain developers through other extensions and npm packages. The incident highlights the ongoing threat of malicious open-source packages in the crypto industry.

This threat involves a malicious open-source package masquerading as a legitimate Solidity Language extension for the Cursor AI Integrated Development Environment (IDE), which is widely used by blockchain developers for smart contract development. The malicious extension was downloaded approximately 54,000 times initially and ranked higher than the legitimate extension due to search algorithm manipulation. Once installed, it deployed malware that enabled remote access to the victim's system using ScreenConnect, a legitimate remote administration tool often abused by attackers. The malware executed various scripts designed to steal sensitive data, specifically targeting wallet passphrases and other credentials related to cryptocurrency assets. After the initial malicious package was removed, attackers quickly published a new malicious package with an inflated download count of 2 million to continue the campaign. Similar attacks have been observed targeting blockchain developers through other extensions and npm packages, indicating a broader campaign exploiting the trust in open-source software repositories. The attack leverages multiple tactics including malware installation, remote access, credential theft, and social engineering through search ranking manipulation. The use of ScreenConnect and scripts for data exfiltration aligns with known adversary techniques such as credential dumping (T1555), input capture (T1056.001), and persistence mechanisms (T1547.001). This incident underscores the persistent risk posed by malicious open-source packages in the cryptocurrency and blockchain development ecosystem, where compromised developer tools can lead to significant financial losses.

Detailed information about The Solidity Language open-source package was used in a $500,000 crypto heist. Get real-time updates, technical details, and mitigati

Title	Severity	Type	Source	Date

Threats Tagged 'cursor ai'

Filter Threats

Threats Tagged 'cursor ai'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility