highMalware
Malicious Claude Code Extension Distributed via Cursor Marketplace, SSH Backdoors Exposed
Compromised VS Code extension potentially affected up to 5,000 developers before removal
Cyber.TechVoid1 min read
Key Takeaways
- A malicious version of Anthropic's Claude Code VS Code extension was distributed via Cursor's marketplace for approximately 11 hours on October 29, 2026.
- The compromised extension contained malware designed to install persistent SSH backdoors on developer machines.
- Up to 5,000 developers may have been exposed to the malware during the distribution window.
- Anthropic and Cursor are actively removing the malicious extension and distributing clean versions.
Related Security News
highMalware
Fake AI Desktop Apps Deploy Crypto Miners via Signed Executables
Threat actors have been distributing malicious loaders and cryptocurrency miners disguised as legitimate desktop applications for OpenAI ChatGPT and Anthropic Claude. The campaign, attributed to 'Yoba', involves creating fake GitHub projects mimicking AI tools such as GPT-5.6 Sol and Claude Opus. These counterfeit applications abuse signed executables to bypass security controls and deploy mining malware onto victim systems.
The Hacker News1 min read
