Web3 developer reveals recruitment phishing scam, infected with trojan after opening Cursor project

Web3 developer brucexu.eth disclosed on November 6 that a fake-recruitment phishing attack in January infected his device with a trojan after he opened a project directory supplied by the "recruiter" in Cursor, though no assets were ultimately lost. The attacker delivered a code repository through a hiring process, and the developer assumed merely viewing code without running it was safe. SlowMist founder Cos, after analyzing the sample, warned that simply opening a project directory can trigger malicious code. After confirming the infection, brucexu.eth moved assets, rotated credentials and reinstalled his system. The case highlights that developer tooling and repository browsing are an underappreciated attack surface in crypto, and users should watch for further SlowMist analysis and similar disclosures from other developers.