Fake Job Interview MCP Auto-Execution Chain via Malicious Repo Clone
Detects a multi-stage attack where an adversary uses a fake job interview theme to lure a user into cloning a malicious repository. The repository contains a Model Context Protocol (MCP) configuration file that, when opened in an IDE like VS Code, Cursor, or Windsurf, leads to the execution of unauthorized or suspicious child processes.
YARA-L
