{
 "tag": "screenconnect",
 "name": "Screenconnect",
 "group": "Other",
 "incidents": [
  {
   "slug": "cursor-fake-solidity-extension-500k-crypto-theft-jul-2025",
   "title": "Fake Solidity extension for the Cursor AI code editor leads to about $500K crypto theft from a developer",
   "url": "https://drains.watch/i/cursor-fake-solidity-extension-500k-crypto-theft-jul-2025",
   "json": "https://drains.watch/i/cursor-fake-solidity-extension-500k-crypto-theft-jul-2025.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "ai": {
    "role": "agent-target",
    "note": "The malicious extension reached the victim through the extension marketplace used by Cursor, an AI-powered code editor; the AI features themselves were not exploited."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "supply-chain",
   "product": "Cursor AI code editor users (Open VSX extensions)",
   "tags": [
    "multi-evm",
    "supply-chain",
    "cursor",
    "ai-code-editor",
    "open-vsx",
    "malicious-extension",
    "solidity",
    "screenconnect",
    "quasar",
    "infostealer",
    "developers",
    "ai"
   ],
   "amountUsd": 500000,
   "victims": 1,
   "startedAt": "2025-07-10",
   "closedAt": "2025-07-10",
   "updatedAt": "2025-07-10T12:00:00Z",
   "summary": "Kaspersky reported on 10 July 2025 that a blockchain developer lost about $500,000 in crypto after installing a fake Solidity extension in Cursor, an AI code editor built on VS Code that gets extensions from the Open VSX registry. The extension gave no Solidity support; it installed ScreenConnect remote-access software, then the Quasar backdoor and a stealer that took browser, email and wallet data, including seed phrases. The attackers used the seed phrases to drain the developer's wallets. Developers should vet editor extensions and never keep seed phrases or funded keys on a coding machine."
  }
 ],
 "changes": [
  {
   "incident": "cursor-fake-solidity-extension-500k-crypto-theft-jul-2025",
   "incidentTitle": "Fake Solidity extension for the Cursor AI code editor leads to about $500K crypto theft from a developer",
   "severity": "high",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2025-07-10",
   "title": "Kaspersky disclosed that a fake Solidity extension aimed at Cursor users led to about $500,000 in stolen crypto from a blockchain developer.",
   "sourceUrl": "https://www.kaspersky.com/about/press-releases/kaspersky-uncovers-500k-crypto-heist-through-malicious-packages-targeting-cursor-developers",
   "url": "https://drains.watch/i/cursor-fake-solidity-extension-500k-crypto-theft-jul-2025"
  }
 ]
}