Trojanized Claude Code Extension Plants an SSH Backdoor

The Claude Code extension version 2.1.313 in the Cursor Marketplace was compromised with a malicious loader that installs an SSH backdoor. This backdoor adds an attacker-controlled SSH key to authorized_keys, attempts to enable local SSH services, and establishes a reverse SSH tunnel to a remote server. It collects system and user reconnaissance data and installs persistence mechanisms on macOS, Linux, and Windows. Communications with the command-and-control server are unencrypted, allowing persistent remote access.

• Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooksMalware2026-10-23
• Midnight Mimosa Malware Campaign Exploits Android Firmware Supply ChainMalware2026-10-20
• Implants in the Supply ChainMalware2026-08-27
• 19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing PayloadsCampaign2026-08-27
• Defending SaaS-based applications against ShinyHunters OAuth abuseUnknown2026-07-14