Cybersecurity firm HiddenLayer uncovers a “CopyPasta License Attack” that exploits Coinbase’s favored AI coding tool, Cursor.

Here’s how carefully concealed backdoor in fake AWS files escaped mainstream notice Files available on the open source NPM repository underscore a growing sophistication.

MystRodX backdoor, active since Jan 2024, uses encrypted payloads and DNS/ICMP triggers for stealthy C2 control.

It is a common, albeit not widely known industry practice for manufacturers of locks used by consumers and businesses to feature manufacturer backdoor codes, Wyden said in a news release Wednesday.