MalwarePublished 31 Oct 2026

Inside a malicious Claude Code-branded extension and its persistent SSH backdoor

Source Microsoft Security Blog

Description

A malicious version of the Claude Code extension (versions 2.1.312 and 2.1.313) was briefly available on the Cursor marketplace, embedding a JavaScript loader that attempts to establish persistent SSH backdoor access. The loader collects host information, adds an attacker-controlled SSH public key to authorized_keys, enables the local SSH service, creates a reverse SSH tunnel, configures persistence mechanisms, and attempts to exfiltrate host details. The incident is limited to the Cursor marketplace; official Microsoft Visual Studio Marketplace and npm packages were not affected. Successful remote access depends on host privileges and SSH configuration. Organizations should identify affected systems, preserve evidence, remove malicious artifacts, and rotate credentials if exposure is suspected.

Impact

The malicious extension enables persistent remote access to affected hosts via an SSH backdoor, potentially allowing attackers to execute commands and maintain long-term control. It collects sensitive host information and environment variable names that may indicate the presence of secrets or credentials. The attack could lead to unauthorized access, data exposure, and lateral movement within affected environments. However, successful exploitation depends on host privileges and SSH configuration. The incident is limited to users who installed or updated the affected versions from the Cursor marketplace during the brief exposure window.

Defensive guidance

The malicious packages were only available on the Cursor marketplace and not on official Microsoft or npm repositories. Organizations should identify and isolate systems that installed or updated the affected versions (2.1.312 and 2.1.313) from the Cursor marketplace, preserve forensic evidence, remove the malicious extension and any persistence artifacts, review endpoint and network telemetry for suspicious SSH activity, and rotate credentials or revoke sessions if exposure is suspected. Microsoft customers can leverage provided Defender XDR detections and hunting queries once available.

Summary

On October 29, 2026, a tampered Claude Code extension (anthropic.claude-code, versions 2.1.312 and 2.1.313) was served on the Cursor extension marketplace for approximately 11 hours. The malicious extension contained injected JavaScript that executed before the legitimate code, using Node.js APIs to collect host and user information, modify files, and execute OS commands. The loader appends an embedded Ed25519 public key to the user's authorized_keys file (marked with 'svc-telemetry'), attempts to enable the local SSH service, and establishes a reverse SSH tunnel with an attacker-controlled server. It also configures platform-specific persistence to maintain access and attempts to send collected host details and environment variable names to the attacker. The malicious package was never distributed via Microsoft Visual Studio Marketplace or npm, and Anthropic's systems were not compromised. The attack chain includes reconnaissance, SSH key installation, reverse SSH forwarding (MITRE ATT&CK T1572), persistence configuration, and data exfiltration attempts. The loader suppresses command output and errors to avoid detection while allowing the extension to function normally.

References

microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 31 Oct 2026, 02:21 UTC

Technical details

References

Community reviews

Related threats