CERT24Official Claude Code VS Code Extension Compromised to Install a Persistent SSH BackdoorLoading data…
CERT24Threat Observatory
Period

Official Claude Code VS Code Extension Compromised to Install a Persistent SSH Backdoor

A malicious version of the Claude Code extension distributed through the compromised Cursor Marketplace installed an SSH backdoor and persistence mechanisms on infected hosts. Cursor said up to 5,000 users may have been affected after installing the version between approximately 2:27 a.m. and 1:35 p.m. PT on October 29, 2026.

← Back to intelligence

Official Claude Code VS Code Extension Compromised to Install a Persistent SSH Backdoor

A malicious version of the Claude Code extension distributed through the compromised Cursor Marketplace installed an SSH backdoor and persistence mechanisms on infected hosts. Cursor said up to 5,000 users may have been affected after installing the version between approximately 2:27 a.m. and 1:35 p.m. PT on October 29, 2026.