Cursor warns users to clean machines and rotate credentials after malicious marketplace updates.
The malicious payload attempts to add unauthorized SSH keys and establish reverse tunnels.
Platform-side removals do not clear persistent components left on local user machines.
Security experts provide scripts to help check endpoints and remove persistence mechanisms.
Read the full story on NexVani Media