Curse has been known to have keyloggers, trojans, and viruses, so I try to avoid downloading from that site. I have WoWMatrix, but I only use that for small addons that aren't really needed (Like Doodle, Bejeweled, LeetPlayer). For the most part I go to the mod's website and get it directly from the creator.
I have checked the curse client from top to toe, there is no such thing as any keylogger, ad, trojan, virus. It's completly clean. Dont know where you got that hoax from, but I do know its not true.