Web3 developers disclose phishing during recruitment, infected with a trojan after opening the Cursor project

According to Web3 developer brucexu.eth, he encountered a phishing scam involving fake recruitment in January this year. After using Cursor to open the project directory provided by the other party, his device was infected with a Trojan, but ultimately there was no asset loss.

He stated that the attacker provided a code repository through the recruitment process; he initially thought it was safe to just view the code without running it, but after analyzing the sample, Yu Xian, the founder of Slow Mist, warned that opening the project directory could also trigger malicious code. After confirming the infection, he transferred assets, rotated credentials, and reinstalled the system.