Cybersecurity Oct 31, 2026 1 min read

Published by Microsoft Security · Oct 31, 2026 · 1:02 AM UTCOn GETSECURE.ai · Nov 1, 2026 · 3:16 PM UTC

Inside a malicious Claude Code-branded extension and its persistent SSH backdoor

Title card · GETSECURE.ai

In this article Attack chain overview Attack chain Host reconnaissance collection SSH authorization and tunnel identities Protocol Tunneling (T1572): reverse SSH forwarding Platfor
Excerpt from Microsoft Security

GETSECURE.ai hasn't published its own summary of this story yet. The complete report is at Microsoft Security:

Read the full story at Microsoft Security →

References

Microsoft Security. (2026, October 31). Inside a malicious Claude Code-branded extension and its persistent SSH backdoor. Microsoft Security. https://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/

Original Source

Microsoft Security Read original →

Inside a malicious Claude Code-branded extension and its persistent SSH backdoor

References

Related Intelligence

Malicious Claude Code extension on Cursor planted SSH backdoors

Malicious Claude Code Extension Served in Cursor Supply Chain Attack

Devs Hit by Trojanized Claude Code Extension for Cursor

A Supply Chain Attack Put Malicious Anthropic Claude Extensions on Thousands of Devices

Get the Signal. Skip the Noise.