Web3 Developer Says Fake Job Offer Led to Trojan Infection Through Cursor Project

According to ChainCatcher, Web3 developer brucexu.eth said he was targeted by a fake job offer in January this year and infected with a Trojan after opening the recruiter's project directory in Cursor. No assets were lost. The attacker provided a code repository through the hiring process. brucexu.eth had believed it was safe to inspect the code without running it, but SlowMist founder Yu Xian warned after analyzing a sample that simply opening the project directory could trigger malicious code. After confirming the infection, brucexu.eth moved his assets, rotated credentials, and reinstalled the operating system.