30 mins ago
Malicious Claude Code extension on Cursor planted SSH backdoors
What's happening
SignalsMonitor is following this as a security story. BleepingComputer is the outlet attached so far. The first report grouped here was at 30 Oct 2026, 14:36 UTC. The headline in use is “Malicious Claude Code extension on Cursor planted SSH backdoors”. This note is SignalsMonitor's own briefing, not the publisher's article.
What we know
A malicious version of Anthropic's Claude Code VS Code extension was distributed through Cursor's extension marketplace for approximately 11 hours on October 29, exposing up to 5,000 developers to malware designed to install persistent SSH backdoors. [...
Story timeline
Reports grouped into this story, earliest first. Exact repeats from the same outlet are collapsed.
- First reported by BleepingComputer
Malicious Claude Code extension on Cursor planted SSH backdoors
Reported by 1 outlet
- BleepingComputer
- BleepingComputerMalicious Claude Code extension on Cursor planted SSH backdoors