ConceptSANDWORM_MODE蠕虫
SANDWORM_MODE
A malicious worm discovered by Socket that spreads by writing malicious MCP servers into local configurations such as Claude Desktop, Cursor, VS Code Continue, and Windsurf, and steals API keys from multiple LLM vendors.
Timeline (last 90 days)
Oct 19
According to Infosecurity Magazine, the SANDWORM_MODE worm discovered by Socket writes malicious MCP servers into the local configurations of Claude Desktop, Cursor, VS Code Continue, and Windsurf, and harvests API keys from nine LLM vendors.
Unverified50%