Inside a Malicious Claude Code-Branded Extension and Its Persistent SSH Backdoor
Microsoft, Saturday, October 31st, 2026
Microsoft analyzes a tampered Claude Code extension served on the Cursor marketplace that installed an SSH key and persistent reverse SSH access.
Cursor reported that tampered copies of the anthropic.claude-code extension (versions 2.1.312 and 2.1.313) were served from about 2:27 AM to 1:35 PM PDT on October 29, 2026.
Microsoft says the packages were never on Visual Studio Marketplace or npm, and Anthropic confirmed its systems were not compromised.
The injected JavaScript loader tries to add an attacker SSH key, enable the local SSH service, set up reverse SSH forwarding, configure persistence and report host details.
Microsoft advises identifying affected installs, preserving evidence, removing artifacts, reviewing telemetry and rotating credentials.