A classy cybercrime operation has efficiently stolen $500,000 in cryptocurrency property from a Russian blockchain developer by means of a malicious extension concentrating on the Cursor AI built-in improvement setting.
The assault, which occurred in June 2025, represents a regarding evolution in provide chain assaults that exploit the rising recognition of AI-assisted improvement instruments.
The incident started when the sufferer, a security-conscious developer who had not too long ago put in a recent working system, looked for a Solidity syntax highlighting extension throughout the Cursor AI IDE.
Regardless of utilizing on-line malware detection providers and sustaining strict safety practices, the developer inadvertently put in a malicious bundle that masqueraded as a official improvement software.
The pretend extension, printed below the title “Solidity Language,” had amassed 54,000 downloads earlier than being detected and eliminated.
What makes this assault notably insidious is its exploitation of search rating algorithms to place the malicious extension above official alternate options.
The extension’s description within the Open VSX registry (Supply – Securelist)
The attackers leveraged the Open VSX registry’s relevance-based rating system, which considers components together with recency of updates, obtain counts, and rankings.
By publishing their malicious extension with a current replace date of June 15, 2025, in comparison with the official extension’s Might 30, 2025 replace, the cybercriminals efficiently manipulated their bundle to seem fourth in search outcomes whereas the genuine extension ranked eighth.
Securelist analysts recognized the malware after conducting a forensic evaluation of the sufferer’s compromised system.
The investigation revealed that the malicious extension contained no precise syntax highlighting performance, as a substitute serving as a dropper for a multi-stage assault chain.
An infection Chain
The malware’s an infection mechanism demonstrates a classy understanding of each social engineering and technical evasion methods.
Search outcomes for “solidity” – the malicious (crimson) and bonafide (inexperienced) extensions (Supply – Securelist)
Upon set up, the malicious extension.js file, positioned at %userprofile%.cursorextensionssolidityai.solidity-1.0.9-universalsrcextension.js, instantly initiated contact with the command and management server at angelic[.]su.
The preliminary PowerShell script retrieved from https://angelic[.]su/recordsdata/1.txt checked for the presence of ScreenConnect distant administration software program on the sufferer’s machine.
If ScreenConnect was not detected, the malware downloaded a secondary script from https://angelic[.]su/recordsdata/2.txt, which then retrieved the ScreenConnect installer from https://lmfao[.]su/Bin/ScreenConnect.ClientSetup.msi.
This official distant entry software was configured to speak with the attackers’ infrastructure at relay.lmfao[.]su, offering persistent entry to the compromised system.
Using official administrative instruments represents a typical tactic employed by superior persistent risk actors to mix malicious exercise with regular system operations.
The assault infrastructure reveals a well-organized operation extending past this single incident.
Researchers found associated malicious packages together with “solsafe” within the npm repository and three further Visible Studio Code extensions: solaibot, among-eth, and blankebesxstnion, all using an identical an infection methodologies and speaking with the identical command and management infrastructure.
Examine dwell malware habits, hint each step of an assault, and make sooner, smarter safety choices -> Strive ANY.RUN now
