Threat video1:00
Cursor Fireworks Key Leak Trojan Build: Detection & IOCs
Attackers used a leaked Fireworks AI key to backdoor a Cursor marketplace extension: 20 IOCs, 9 detection rules and a free Splunk SPL rule.
Read the full threat intel for Cursor Fireworks Key Leak Trojan Build: Detection & IOCs →
Chapters
- 0:00The hookCursor VS Code supply-chain: 19 indicators.
- 0:05The storySome traces contained unredacted credentials.
- 0:11Attack pathFireworks exposes Cursor-issued access key.
- 0:25AttributionNo threat actor is attributed.
- 0:30Indicators of compromise19 indicators to hunt.
- 0:37MITRE ATT&CK techniques14 ATT&CK techniques are mapped.
- 0:42Remediation14 remediation steps are listed, 6 of them immediate.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Cursor VS Code supply-chain: 19 indicators.
0:05Some traces contained unredacted credentials.
0:12Fireworks exposes Cursor-issued access key.
0:26No threat actor is attributed. Confidence: low.
0:3119 indicators to hunt.
0:3714 ATT&CK techniques are mapped.
0:4214 remediation steps are listed, 6 of them immediate.
0:509 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.