Curse has been known to have keyloggers, trojans, and viruses, so I try to avoid downloading from that site. I have WoWMatrix, but I only use that for small addons that aren't really needed (Like Doodle, Bejeweled, LeetPlayer). For the most part I go to the mod's website and get it directly from the creator.
I have checked the curse client from top to toe, there is no such thing as any keylogger, ad, trojan, virus. It's completly clean. Dont know where you got that hoax from, but I do know its not true.
It's not a hoax actually. It was the ads that had a keylogger.
IMO if you don't have an authenticator you can never be too careful.
I download my addons off wowinterface or curse. Always use NoScript and AdBlock addons for firefox