https://howtonotcode.com/story/2003-sophos-attackers-are-using-cursor-to-build-edrevasion-tools