DeeperML - #malware

Developers using the AI-powered coding assistant Cursor have fallen victim to a sophisticated crypto heist, losing an estimated $500,000. The incident involved a malicious extension, disguised as a legitimate tool for Solidity developers, which was distributed through the Open VSX marketplace. This marketplace, which serves as a source for extensions for AI development tools like Cursor, does not undergo the same stringent security checks as other marketplaces, creating a vulnerability that attackers exploited. The fake extension, titled "Solidity Language," managed to gain tens of thousands of downloads, likely boosted by bot activity, and successfully deceived even experienced users.

The malicious extension operated by silently executing PowerShell scripts and installing remote access tools on the victim's computer. Upon installation, the extension contacted a command-and-control server to download and run these harmful scripts. The attackers then leveraged the installed remote access application, ScreenConnect, to gain full control of the compromised system. This allowed them to upload additional malicious payloads, specifically targeting the developer's crypto wallet passphrases and ultimately siphoning off approximately $500,000 in cryptocurrency assets. The attackers also employed algorithm tricks to ensure the malicious extension ranked highly in search results, further increasing its visibility and the likelihood of it being downloaded by unsuspecting developers.

This incident highlights a growing trend of attacks that leverage vulnerabilities within the open-source software ecosystem. While the Solidity Language extension itself offered no actual functionality, its deceptive appearance and elevated search ranking allowed it to trick users into installing malware. Security experts are urging developers to exercise extreme caution when installing extensions, emphasizing the importance of verifying extension authors and using robust security tools. The weaponization of AI-enhanced development tools serves as a stark reminder that the very tools designed to enhance productivity can be turned into vectors for significant financial loss if not handled with the utmost security awareness.


References :

• Lukasz Olejnik: Malicious extension to AI software development assistant Cursor contained malware. It silently executed PowerShell scripts, installed remote access tools, and stole $500K in crypto from a blockchain dev. It ranked high in search due to algorithm tricks, fooling even experienced users. Always verify extensions, check author names, and use real security tools—AI-enhanced dev tools can be weaponized too.
• Securelist: Code highlighting with Cursor AI for $500,000
• securelist.com: Malicious extension to AI software development assistant Cursor contained malware. It silently executed PowerShell scripts, installed remote access tools, and stole $500K in crypto from a blockchain dev.
• cyberinsider.com: Fake Visual Studio Code extension for Cursor led to $500K theft

Classification:

• HashTags: #Malware #CursorAI #Cryptography
• Company: Kaspersky
• Target: Blockchain Developers
• Product: Cursor AI
• Feature: Malicious Extension
• Malware: Quasar
• Type: Malware
• Severity: Major

The Rare Werewolf APT group, also known as Librarian Ghouls and Rezet, has been actively targeting Russian enterprises and engineering schools since at least 2019, with activity continuing through May 2025. This advanced persistent threat group distinguishes itself by primarily utilizing legitimate third-party software instead of developing its own malicious tools. The attacks are characterized by the use of command files and PowerShell scripts to establish remote access to compromised systems, steal credentials, and deploy the XMRig cryptocurrency miner. The campaign has impacted hundreds of Russian users, with additional infections reported in Belarus and Kazakhstan.

The group's initial infection vector typically involves targeted phishing emails containing password-protected archives with executable files disguised as official documents or payment orders. Once the victim opens the attachment, the attackers deploy a legitimate tool called 4t Tray Minimizer to obscure their presence on the compromised system. They also use tools like Defender Control to disable antivirus software and Blat, a legitimate utility, to send stolen data via SMTP. The attackers actively refine their tactics and a new wave of attacks emerged immediately after a slight decline in December 2024.

A key aspect of the Rare Werewolf APT's strategy involves the use of a Windows batch script that launches a PowerShell script, scheduling the victim system to wake up at 1 AM local time and providing a four-hour window for remote access via AnyDesk. The machine is then shut down at 5 AM through a scheduled task, minimizing the chance of detection. The attackers also collect information about available CPU cores and GPUs to optimally configure the crypto miner. Besides cryptomining, the group has also been known to steal sensitive documents, passwords, and compromise Telegram accounts.


References :

• The Hacker News: Research focusing on the group's methods, including its use of legitimate software.
• therecord.media: Report of the malicious campaign targeting Russian enterprises.

Classification:

• HashTags: #Cybersecurity #APT #Malware
• Target: Russian Enterprises
• Attacker: Rare Werewolf
• Malware: Rare Werewolf Malware
• Type: Hack
• Severity: Major