News
cybersecurity Hacktober 2026: Cyberattacks Hit Binance, Polymarket, PHP, Node.js, and AI Platforms - CyberPress threat-intel Hackers Gain Unauthorized Access to WS Audiology CRM Environment and Operational IT Systems - GBHackers cybersecurity Critical Incus and LXD Vulnerabilities Allow Unauthenticated Attackers to Take Over Virtual Machines - CyberPress cybersecurity New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value - The Hacker News threat-intel Malicious Claude Code Extensions in Cursor Marketplace Install Persistent SSH Backdoors on Windows and macOS - GBHackers cybersecurity FBI Confirms North Korean Hackers Stole Over $6 Billion in Binance Cryptocurrency Attack - CyberPress threat-intel Hackers Weaponize ARTEX AI Agents to Automate Network Intrusions and Steal Sensitive Data - GBHackers threat-intel Hacktober 2026: Major Cyberattacks Hit Binance, PHP, Node.js, LiteLLM, and Pentagon - GBHackers cybersecurity Cursor Warns of Malicious Claude Code Extensions Installing Persistent SSH Backdoor on Developer Systems - CyberPress threat-intel New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Profile Victims and Rank Stolen Data - GBHackers threat-intel FBI Confirms North Korean Hackers Stole Over $6 Billion From Binance in Massive Crypto Attack - GBHackers threat-intel Critical Incus and LXD Vulnerabilities Allow Unauthenticated Attackers to Gain Full Cluster Access - GBHackers ai New AI-driven Windows malware feeds stolen data to Claude to rank victims’ assets by value, then deletes itself — payload builds custom target assessment, can switch models if one refuses, or skip the AI step entirely - Tom's Hardware - Anthropic - Claude AI cybersecurity FBI links $6.3 billion Binance crypto heist to North Korean hackers - BleepingComputer cybersecurity Alpine Linux rebuilds GitLab after attempted RCE attack - BleepingComputer
1 / 15
All news ›
Threat Intel

Malicious Claude Code Extensions in Cursor Marketplace Install Persistent SSH Backdoors on Windows and macOS

GBHackers ·

Malicious Claude Code extensions distributed through Cursor’s VS Code The Extension Marketplace tried to create persistent SSH backdoors on Windows and macOS developer systems. The affected packages were the Anthropic.claude-code versions 2.1.312 and 2.1.313, which were available on October 29, 2026, between approximately 2:27 a.m. and 1:35 p.m. Cursor stated that Anthropic did not develop […] The post Malicious Claude Code Extensions in Cursor Marketplace Install Persistent SSH Backdoors on Windows and macOS appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

Continue on GBHackers ↗ ‹ All news Get the newsletter

The summary and image come from GBHackers; the image is shown from their website.