Act
active
Malicious Claude Code-branded IDE extension installs persistent SSH backdoor
- Engineer — Act: A trojanized Claude Code extension targeting Cursor/VS Code installs a persistent SSH backdoor on developer machines — audit all installed IDE extensions for this package and follow Microsoft’s remediation steps to remove backdoor artifacts and rotate any credentials accessible from affected workstations.
- SOC/IR — Act: Microsoft’s analysis includes detection guidance; sweep developer endpoints for the malicious extension presence and hunt for anomalous outbound SSH connections or new authorized_keys entries on workstations since late October 2026.
- Leader — Act: A supply-chain compromise of developer tooling with persistent backdoor access is a same-week risk event — confirm whether engineers use Cursor/VS Code extensions from untrusted sources, assess any exposure, and consider a brief to engineering leadership on extension vetting policy.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.