The compromised versions attempted to plant SSH keys and establish persistent remote access; Anthropic says an attacker used access to Cursor’s marketplace to publish the tampered extension.
CL-UNK-1211 targets government Linux servers using AI-assisted scripts, PHP web shells, and SysGoRAT to steal credentials and ...
A tampered Claude Code 2.1.313 build added an svc-telemetry SSH key and persistence; Cursor says up to 5,000 users installed ...
Akamai’s Fraud and Abuse Report 2026 describes a routine that favors the scammers: when a counterfeit store is pulled offline, the operators can have a replacement running within hours. One retail ...