Search: “Cursor”

29 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Malware 80 Vulnerability 70 AI safety & security 37 Exploit / PoC 23 Policy & legal 19 Ransomware 19 Threat actor 18 Phishing & fraud 17 Industry 16 Data breach 13 AI industry 10 Model release 8 AI tools & infra 8 AI research 4

SeverityAll critical 71 high 90 medium 116 low 26 info 48

Infostealers Target Claude, Cursor, Codex and Other AI Agents to Steal Credentials and Sensitive Data

Gen Digital researchers report infostealer families Amatera, Remus and CallbackBeaver now harvest Claude, Cursor and Codex agent data, including tokens and MCP configs.

Gen Digital researchers found commodity infostealers extending their collection rules to local AI coding agent data from Claude, Cursor, Codex, Cline, Continue and OpenCode on Windows and macOS. Amatera targets Cline and Continue, Remus targets Claude, Cursor and OpenCode, and CallbackBeaver added Claude and Cursor with more than 5,000 samples observed in 30 days; Djinn Stealer hits Claude, Codex, Gemini, Cline, OpenCode and Kilo on macOS. Stolen data includes access and refresh tokens, prompt histories, conversation databases and MCP configurations holding API keys, potentially exposing connected source-control, cloud and ticketing systems. Remus is assessed as a Lumma Stealer variant using EtherHiding C2 resolution via Ethereum smart contracts.

GBHackersSep 9, 07:05 UTC · 7d agoMalware in the wild1

Hackers Target Claude, Cursor and Codex AI Agents to Steal Tokens and Prompt Histories

Gen Digital found infostealers like Amatera and Remus stealing AI coding agent tokens, prompt histories, and MCP configs from infected Windows and macOS machines.

Gen Digital analysts observed Amatera and Remus detections among tens of thousands of protected Windows users over three months, with Amatera targeting Cline and Continue data and Remus targeting Claude, Cursor, and OpenCode. CallbackBeaver added Cursor and Claude to its collection scope with more than 5,000 samples in 30 days, while macOS-focused Djinn Stealer has been associated with Claude, Codex, Gemini, Cline, OpenCode, and Kilo. The stealers harvest access and refresh tokens, prompt histories, and MCP configuration files that can expose source control, ticketing, databases, cloud resources, and sensitive project context for follow-on fraud. Many stealers add targets via remotely managed rules, meaning this is an adaptation of existing infostealers rather than a new vulnerability in the AI tools themselves.

Cyber Security NewsSep 9, 11:41 UTC · 7d agoMalware in the wild2

Analysis of the SoumniBot Android banker

Kaspersky SecurelistApr 17, 10:00 UTC · Apr 17, 2024Malware

LummaC2 Malware Deploys New Trigonometry-Based Anti

The Hacker NewsJan 24, 04:26 UTC · Jan 24, 2024Malware

Spotting RATs: Delphi wrapper makes the analysis harder

Security AffairsJul 8, 13:16 UTC · Jul 8, 2019Malware

FOMO in the SOC: Where AI Platforms like Claude Actually Fit

The Hacker NewsAug 3, 11:30 UTC · Aug 3, 2026Malware

AI Coding Agents Found Triggering Endpoint Security Rules Built to Catch Attackers

The Hacker NewsJul 8, 17:02 UTC · Jul 8, 2026Malware1

North Korean Hackers Use Fake Coding Tasks to Steal Crypto

Infosecurity MagazineJun 8, 15:00 UTC · Jun 8, 2026Malware

New Argamal RAT targets hentai gamers

Kaspersky SecurelistJun 3, 09:00 UTC · Jun 3, 2026Malware

Infostealer Lumma Evolves With New Anti

Infosecurity MagazineNov 20, 16:30 UTC · Nov 20, 2023Malware

Poisoning the Well: Banking Trojan Targets Google Search Results

Cisco TalosNov 2, 15:55 UTC · Nov 2, 2017Malware

PAPERMILL Malware Campaign Abuses Signed Notepad++ to Deliver VenomRAT to Windows Users

JUMPSEC tracks PAPERMILL, a China-nexus phishing campaign using a signed Notepad++ binary, libcurl.dll sideloading, and Donut loaders to deploy VenomRAT against Indian tax-audit targets.

PAPERMILL delivers ISO disk images via tax-audit phishing emails that passed SPF, DKIM, and DMARC, containing a renamed Authenticode-signed Notepad++ executable and a malicious libcurl.dll that proxies curl functions while executing loader logic in DllMain. The chain uses Mark-of-the-Web bypasses, anti-sandbox sleeps, UAC elevation prompts, Registry persistence, and a Donut shellcode loader to reflectively load .NET VenomRAT v6.0.3 with HVNC and credential-stealing capability, with C2 at 154.36.188.201:4449. JUMPSEC assesses the campaign as China-nexus, financially motivated, and Silver Fox-adjacent rather than definitively Silver Fox-operated.

GBHackersupdated 12:23 UTC · 4h agofirst 09:36 UTC · 7h agoMalware in the wild 2 sources

Hackers Use ClickFix Lures to Deploy MacSync Stealer and Bypass macOS Security.

ClickFix malvertising campaigns deliver MacSync, a macOS infostealer sold as MaaS that bypasses Gatekeeper via Terminal commands and steals credentials.

Threat actors use ClickFix social-engineering lures, SEO poisoning, and malvertising impersonating brands like Claude, ChatGPT, Zoom, and Docker to trick users into pasting curl-to-zsh commands into Terminal, evading Gatekeeper and notarization checks. The MacSync Stealer (formerly Mac.c, emerged April 2025, linked to developer 'Mentalpositive') is a 64-bit Mach-O stager with single-byte XOR string obfuscation that daemonizes, polls C2 with custom API-key headers, streams AppleScript payloads into osascript, and persists via fake LaunchAgents. It steals browser credentials, Keychain data, SSH keys, session tokens, and crypto wallets, exfiltrating archives in 10MB HTTP PUT chunks. Microsoft documented more than 30 related MacSync domains.