Helpnetsecurity Trojanized Claude Code Extension Plants SSH Backdoor in Cursor Marketplace
Article Content
- •A trojanized version of the Claude Code extension was available for 11 hours, affecting up to 5,000 users.
- •The malicious extension added an SSH key and attempted to establish a persistent backdoor.
- •Cursor has removed the malicious version and taken measures to secure its marketplace.
On October 29, 2026, a malicious version of the Claude Code extension (version 2.1.313) was available in the Cursor VS Code extension marketplace for approximately 11 hours, affecting up to 5,000 users. This version, not developed by Anthropic, contained a 66-line loader that added an attacker's SSH key, attempted to enable SSH access, and established a reverse SSH tunnel to an external server. The malicious code executed immediately upon loading the extension, collecting user and system information without user interaction. Cursor removed the compromised extension and temporarily took its marketplace offline, later confirming that no other extensions were affected. As of October 30, the attacker's server has been taken offline, but users are advised to follow remediation steps as the backdoor may persist even after uninstalling the extension.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (37)
Following this threat?
Track Anthropic in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
Which versions are affected?
What should I do if I installed the extension?
Is there ongoing exploitation of this vulnerability?
Continue Reading
North Korean Hackers Steal $6.3 Billion from Binance in Record Crypto Heist On October 29, 2026, Binance, the world's largest cryptocurrency exchange, reported a massive security breach resulting in the theft of approximately $6.3 billion across ten blockchains. The attack is attributed to North Korea's TraderTraitor hacking group, which gained access via a compromised DevOps engineer's… 
China-Linked Hackers Exploit PHP2Shell Vulnerabilities to Breach U.S. Government Systems On October 21, 2026, the PHP development team released patches for two critical vulnerabilities in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow unauthenticated remote code execution. These vulnerabilities were actively exploited by a suspected China-linked threat actor who compromised 25…