AMOS Stealer delivered via Cursor AI agent session

Reported 25 Apr 2026 by otx · Severity: medium

On April 23, 2026, Field Effect MDR identified AMOS Stealer malware delivered through a novel technique exploiting Cursor AI agent sessions running Claude Code. The attack employed social engineering to manipulate operators into prompting the AI agent to download and execute mali