CursorJack Lab

A backend developer set up his workstation and installed Cursor IDE. While browsing forums and social media looking for MCP integrations for cloud resource management and workflow automation, he came across what appeared to be a useful tool and installed it without reviewing the configuration carefully. Later that day he noticed his cloud credentials folder had been wiped. A few hours later, the billing team flagged unusual charges on the account originating from regions he had never worked in. You are tasked with investigating the workstation and the associated cloud account activity to reconstruct what happened.