Inside a malicious Claude Code-branded extension and its persistent SSH backdoor
- Published
- Record updated
Summary
Cursor reported that a tampered copy of the Claude Code extension (anthropic.claude-code, versions 2.1.313 and 2.1.312) was served in the Cursor extension marketplace for a few hours on October 29, 2026. The injected JavaScript loader runs when the extension module loads and attempts to add an attacker-controlled SSH key, enable the local SSH service, set up reverse SSH forwarding, configure persistence, and report host details. Microsoft states that the Visual Studio Marketplace and npm packages were not affected.
Mitigation
Organizations should identify systems that installed or automatically updated to this version from the Cursor marketplace, preserve evidence, remove confirmed malicious artifacts, review endpoint and network telemetry, and rotate credentials or revoke sessions when investigation indicates exposure.
Related items
- MediumAppraisal by AI: Model-driven victim prioritization in the VOLTA infostealerSame vendor · Cisco Talos Blog
- Medium“Black October” for AI Developer PlatformsSame vendor · Wiz Research Blog
- MediumCritical Linux kernel flaw allows remote root attacks on MPTCP serversSame vendor · BleepingComputer
- MediumA Supply Chain Attack Put Malicious Anthropic Claude Extensions on Thousands of DevicesSame vendor · Wired (Security)
- InfoThe biggest names in AI are backing a new way to opt out of scrapingSame vendor · The Verge (AI)