A post by @SlowMist_Team on X.

SlowMist flagged a recruitment phishing campaign in which simply opening a malicious project in the Cursor code editor triggered a malware infection, highlighting how developer tooling has become an attack surface. The security firm amplified a detailed breakdown shared by @brucexu_eth, which traced the attack chain from a fake job lure to code execution on the victim's machine. The incident matters because Cursor has become a popular AI-assisted development environment, so a single cloned repository can compromise a developer's credentials and, by extension, their wallets and protocol access. No specific dollar losses, token prices, or TVL figures were disclosed in the alert. What to watch next: whether other security researchers confirm the vector and whether teams adopt stricter review of unfamiliar repositories before opening them in Cursor.