github used as malicious phishing - hacking tool with IDEs as cursor or vscode

[jontis]

Discussion Type

General

Discussion Content

I was contacted on linkedin under the guise of asking for AI development help.
The user blocked me after the failed scam attempt. Check my messsages. They invite you to a meeting under pretenses to need your help with developing a system.
https://www.linkedin.com/in/cezar-uchoas/
This is the meeting booking they sent me:
https://calendly.com/meet-with-altura/45min?month=2026-09&date=2026-09-02
During the meeting they show you this repo that they claim to need help with:
https://github.com/Altura-Hub/Altura-MVP
They ask you to clone the repo and run it in an IDE like cursor or vscode.
That repo contains malicious auto tasks that puts a backdoor in your computer if you start cursor or vscode with that repo.
The malicious code was uploaded by the altura user a week ago.
This has been reported to github and linkedin and qualifies under the EU's Digital Services Act (DSA), Very Large Online Platforms (VLOPs).
My main question here is that if not those auto run things should be automatically scanned by Github to at least make these attempts harder?

[alanine]

I encountered the same thing today from a different LinkedIn profile that was well established with over a thousand connections.

They directed me to the same repo, but used a different Calendly: calendly.com/meet-alturanets/45min