News
cybersecurity Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access - The Hacker News threat-intel Hackers Impersonate IT Help Desk on Microsoft Teams to Gain Domain Admin Access via AD CS Attacks - GBHackers threat-intel Hackers Distribute Malicious Claude Code Extension on Cursor Marketplace to Install Persistent SSH Backdoor - GBHackers threat-intel Hackers Exploit PHP2Shell RCE Vulnerabilities to Gain Root Access on Palo Alto Firewalls - GBHackers threat-intel Claude AI Exploits Gaps in Safety Monitoring to Develop Self-Preservation and Deceptive Behaviors - GBHackers threat-intel WordPress RCE Vulnerability Under Active Attack With Over 58,000 Exploit Attempts Blocked - GBHackers cybersecurity Hackers Exploit WordPress RCE Flaw as Wordfence Blocks Over 60,000 Attacks in 24 Hours - CyberPress cybersecurity Anthropic Reveals How Claude AI Bypassed Safety Monitors Using Harmless-Looking Training Data - CyberPress cybersecurity Hackers Exploit PHP2Shell Vulnerabilities to Gain Root Access to Palo Alto Firewalls Using Fragnesia - CyberPress threat-intel Russian Hackers Exploit MDaemon Mail Server Flaw to Install Backdoors Without User Interaction - GBHackers cybersecurity Microsoft Warns of Trojanized Claude Code Extension Planting Persistent SSH Backdoor - CyberPress ai Anthropic's Claude Bypasses AI Safety Checks, Triggering Blackmail and Code Sabotage in Tests - CyberSecurityNews - Anthropic - Claude AI cybersecurity Hackers Impersonate IT Help Desk on Microsoft Teams to Hijack Active Directory Accounts and Steal Data - CyberPress cybersecurity Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38% - The Hacker News cybersecurity Inside a malicious Claude Code-branded extension and its persistent SSH backdoor - Microsoft Security Blog
1 / 15
All news ›
Threat Intel

Hackers Distribute Malicious Claude Code Extension on Cursor Marketplace to Install Persistent SSH Backdoor

GBHackers ·

Microsoft has warned that malicious Claude Code extensions distributed through Cursor’s marketplace attempted to install a persistent SSH backdoor on developer workstations. The trojanized packages, anthropic.claude-code versions 2.1.312 and 2.1.313, combined legitimate extension functionality with injected JavaScript that prepared unauthorized remote access. Cursor disclosed the incident on October 29, 2026, reporting availability between approximately 2:27 […] The post Hackers Distribute Malicious Claude Code Extension on Cursor Marketplace to Install Persistent SSH Backdoor appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

Continue on GBHackers ↗ ‹ All news Get the newsletter

The summary and image come from GBHackers; the image is shown from their website.