News
cybersecurity Hacktober 2026: Cyberattacks Hit Binance, Polymarket, PHP, Node.js, and AI Platforms - CyberPress threat-intel Hackers Gain Unauthorized Access to WS Audiology CRM Environment and Operational IT Systems - GBHackers cybersecurity Critical Incus and LXD Vulnerabilities Allow Unauthenticated Attackers to Take Over Virtual Machines - CyberPress cybersecurity New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value - The Hacker News threat-intel Malicious Claude Code Extensions in Cursor Marketplace Install Persistent SSH Backdoors on Windows and macOS - GBHackers cybersecurity FBI Confirms North Korean Hackers Stole Over $6 Billion in Binance Cryptocurrency Attack - CyberPress threat-intel Hackers Weaponize ARTEX AI Agents to Automate Network Intrusions and Steal Sensitive Data - GBHackers threat-intel Hacktober 2026: Major Cyberattacks Hit Binance, PHP, Node.js, LiteLLM, and Pentagon - GBHackers cybersecurity Cursor Warns of Malicious Claude Code Extensions Installing Persistent SSH Backdoor on Developer Systems - CyberPress threat-intel New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Profile Victims and Rank Stolen Data - GBHackers threat-intel FBI Confirms North Korean Hackers Stole Over $6 Billion From Binance in Massive Crypto Attack - GBHackers threat-intel Critical Incus and LXD Vulnerabilities Allow Unauthenticated Attackers to Gain Full Cluster Access - GBHackers ai New AI-driven Windows malware feeds stolen data to Claude to rank victims’ assets by value, then deletes itself — payload builds custom target assessment, can switch models if one refuses, or skip the AI step entirely - Tom's Hardware - Anthropic - Claude AI cybersecurity FBI links $6.3 billion Binance crypto heist to North Korean hackers - BleepingComputer cybersecurity Alpine Linux rebuilds GitLab after attempted RCE attack - BleepingComputer
1 / 15
All news ›
Cybersecurity

Cursor Warns of Malicious Claude Code Extensions Installing Persistent SSH Backdoor on Developer Systems

CyberPress ·

Cursor has disclosed malicious versions of the Anthropic.claude-code extension in its VS Code Extension Marketplace that attempted to install a persistent SSH backdoor on Windows and macOS developer systems. The incident affected versions 2.1.312 and 2.1.313, which Cursor said Anthropic did not develop. The tampered packages were available between approximately 2:27 a.m. and 1:35 p.m. […] The post Cursor Warns of Malicious Claude Code Extensions Installing Persistent SSH Backdoor on Developer Systems appeared first on Cyber Security News .

Continue on CyberPress ↗ ‹ All news Get the newsletter

The summary and image come from CyberPress; the image is shown from their website.