{"success":true,"data":{"id":"fake-cursor-ai-subscription-expiry-lure","label":"Fake Cursor AI editor subscription expiry phishing — impersonates Cursor with subscription-expired or billing-failed urgency + renew CTA at a non-cursor.com host. Abnormal Security 2025-2026.","description":"Phishing emails impersonating Cursor AI editor claiming a Pro or Business subscription has expired or a payment has failed, directing victims to a fake renewal page harvesting login credentials and payment card data. Three-part detection: (1) Cursor AI / Pro / Business / Teams subscription language, (2) subscription-expired or billing-failed urgency, (3) renew / restore / billing-update CTA with off-cursor.com or off-cursor.sh link. Abnormal Security 2025-2026 documented AI developer tool impersonation campaigns; active campaigns targeting developers confirmed. Cursor's rapid adoption (millions of developer users) makes it an attractive impersonation target, especially given developers' high likelihood of having paid subscriptions linked to corporate accounts.","tier":"danger","category":"scam","isThin":false}}