Cursor backdoor WATCH
For anyone who installed or updated from the Cursor marketplace during the stated window, uninstalling alone is insufficient because the payload drops persistence. Cursor provides indicators and remediation scripts; credentials accessible from affected hosts should be rotated from a trusted system.
Next stepIf installed or updated in the exposure window, isolate and remediate the host with Cursor’s indicators, then rotate credentials from a trusted system.