Web3 Developers Disclose Recruitment Phishing Scam, Contract Trojan After Opening Cursor Project

on November 6, Web3 developer brucexu.eth disclosed falling victim to a fake recruitment phishing attempt in January this year. After using Cursor to open a project directory provided by the attackers, his device was infected with a trojan, though no assets were ultimately lost.

He explained that the attackers shared a code repository via the recruitment process; he had initially assumed that merely viewing without executing the code would be safe, but SlowMist founder Yuxian cautioned after analyzing the sample that simply opening a project directory could also trigger malicious code. Upon confirming the infection, he transferred his assets, rotated his credentials, and reinstalled the system.