A malicious version of Anthropic's Claude Code VS Code extension was distributed through Cursor's extension marketplace for approximately 11 hours on October 29, exposing up to 5,000 developers to malware designed to install persistent SSH backdoors.
Malicious Claude Code extension on Cursor planted SSH backdoors
About this summary. This is a short excerpt from the description that BleepingComputer published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.bleepingcomputer.com/news/security/malicious-claude-code-extension-on-cursor-planted-ssh-backdoors/
Source attribution: headline and facts are from BleepingComputer (bleepingcomputer.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Official Claude Code VS Code Extension Compromised to Install Persistent SSH Backdoor
Cybersecurity researchers have disclosed that the official Anthropic Claude Code extension was compromised on the Open VSX registry to install a persistent SSH backdoor…
Inside a malicious Claude Code-branded extension and its persistent SSH backdoor
Attack chain overviewAttack chain Host reconnaissance collection SSH authorization and tunnel identities Protocol Tunneling (T1572): reverse SSH forwarding…
Claude Code extension poisoned with persistent SSH backdoor
A tampered build of Anthropic’s Claude Code extension for VS Code-compatible editors planted an SSH backdoor on developers’ machines, researchers at macOS security firm…
Combinatorial Lock for Trojan-Resilient AI Engines via Hash-Assisted Spectral Filtering
arXiv:2610.33437v1 Announce Type: new Abstract: Multi-trigger backdoor attacks, in which heterogeneous trigger mechanisms (e.g., patch, blend, warping, and the…
333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email
Unknown hackers hijacked more than 300 Tor exit nodes and reconfigured them to favor unencrypted email traffic and redirect SSH connections through servers they…
Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor
Copies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, that were downloaded from rankmath.com or delivered as updates between 20:02 UTC on…