Inside a malicious Claude Code-branded extension and its persistent SSH backdoor

Reported by Microsoft Security (Microsoft Security Research)

Summary by Cyber Security News31 Oct 2026, 02:02 CET

About this summary. This is a short excerpt from the description that Microsoft Security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/

Attack chain overviewAttack chain Host reconnaissance collection SSH authorization and tunnel identities Protocol Tunneling (T1572): reverse SSH forwarding Platform-specific startup persistence Mitigation and protection guidanceImmediate actions Remediation actions Follow-up Investigation and recovery Microsoft Defender XDR detections Threat intelligence reports Microsoft Defender XDR Threat analytics Advanced hunting queries MITRE ATT&CK techniques Indicators of compromise…

Read the full article at Microsoft Security →

Source attribution: headline and facts are from Microsoft Security (microsoft.com). Summary method: excerpt of the source description. See our source attribution policy.