CERT24Malicious Claude Code extension on Cursor planted SSH backdoorsLoading data…
CERT24Threat Observatory
Period

Malicious Claude Code extension on Cursor planted SSH backdoors

A malicious version of the Claude Code VS Code extension was available in Cursor’s extension marketplace for approximately 11 hours on October 29. The extension potentially exposed up to 5,000 developers to malware designed to install persistent SSH backdoors.

← Back to intelligence

Malicious Claude Code extension on Cursor planted SSH backdoors

A malicious version of the Claude Code VS Code extension was available in Cursor’s extension marketplace for approximately 11 hours on October 29. The extension potentially exposed up to 5,000 developers to malware designed to install persistent SSH backdoors.