Stolen Fireworks AI Key Led to Cursor Data Breach and Trojanized Claude Code Extension

Blog

Byadmblake November 15, 2026

The compromise of Anthropic’s official Claude Code extension on Cursor’s extension marketplace was the result of the theft of an access key that was exposed in the wake of a breach targeting Fireworks AI. “An attacker obtained an access key we had issued to Fireworks,” Cursor said in a Friday update. “The key was exposed…

“An attacker obtained an access key we had issued to Fireworks,” Cursor said in a Friday update. “The key was exposed by Fireworks, and the attacker used it to copy data from a read-only

Blog

Malicious npm Package Modifies Local ‘ethers’ Library to Launch Reverse Shell Attacks

Cybersecurity researchers have discovered two malicious packages on the npm registry that are designed to infect another locally installed package, underscoring the continued evolution of software supply chain attacks targeting the open-source ecosystem. The packages in question are ethers-provider2 and ethers-providerz, with the former downloaded 73 times to date since it was published on

Read More Malicious npm Package Modifies Local ‘ethers’ Library to Launch Reverse Shell Attacks
Blog

Fortinet FortiGate Under Active Attack Through SAML SSO Authentication Bypass

Threat actors have begun to exploit two newly disclosed security flaws in Fortinet FortiGate devices, less than a week after public disclosure. Cybersecurity company Arctic Wolf said it observed active intrusions involving malicious single sign-on (SSO) logins on FortiGate appliances on December 12, 2025. The attacks exploit two critical authentication bypasses (CVE-2025-59718 and CVE-2025-59719

Read More Fortinet FortiGate Under Active Attack Through SAML SSO Authentication Bypass
Blog

MintsLoader Delivers StealC Malware and BOINC in Targeted Cyber Attacks

Threat hunters have detailed an ongoing campaign that leverages a malware loader called MintsLoader to distribute secondary payloads such as the StealC information stealer and a legitimate open-source network computing platform called BOINC. “MintsLoader is a PowerShell based malware loader that has been seen delivered via spam emails with a link to Kongtuke/ClickFix pages or…

Read More MintsLoader Delivers StealC Malware and BOINC in Targeted Cyber Attacks
Blog

OtterCookie v4 Adds VM Detection and Chrome, MetaMask Credential Theft Capabilities

The North Korean threat actors behind the Contagious Interview campaign have been observed using updated versions of a cross-platform malware called OtterCookie with capabilities to steal credentials from web browsers and other files. NTT Security Holdings, which detailed the new findings, said the attackers have “actively and continuously” updated the malware, introducing versions v3 and…

Read More OtterCookie v4 Adds VM Detection and Chrome, MetaMask Credential Theft Capabilities
Blog

Identity-Based AI Attack Threatens Security of Enterprise Data

“Workflow identity hijacking” can bypass standard security controls and hijack an organization’s data by sending a basic request through an unauthenticated entry point.

Read More Identity-Based AI Attack Threatens Security of Enterprise Data
Blog

GitHub to Disable npm Install Scripts by Default to Stop Supply Chain Attacks

GitHub has announced what it said are “breaking changes” coming to npm version 12, one of which turns off install scripts by default to combat software supply chain threats. The changes aim to combat attack techniques that abuse the “npm install” command to trigger the execution of malicious code using npm lifecycle hooks. “Npm install”…

Read More GitHub to Disable npm Install Scripts by Default to Stop Supply Chain Attacks

Related