Threat Intel
Malicious Claude Code Extension and Persistent SSH Backdoor in Cursor Marketplace
A tampered Claude Code extension appeared in the Cursor marketplace, adding an attacker‑controlled SSH key and establishing a persistent backdoor. Systems that installed the extension during the 11‑hour window are at risk. Defenders should inventory, remove the extension, delete malicious keys, and monitor for reverse tunnels.
What happened
On Oct 29 2026 a tampered copy of the Claude Code extension (versions 2.1.313 and 2.1.312) appeared briefly in the Cursor extension marketplace. The malicious package executed on load, adding an attacker‑controlled SSH key, enabling the local SSH service, and attempting reverse SSH forwarding.
The attacker’s code also wrote persistence artifacts to the host, so even if the reverse tunnel failed, the extension could still leave a foothold. The malicious activity was limited to the Cursor marketplace; no other distribution channels were affected.
Who is affected
Any organization that installed or automatically updated the affected Claude Code extension from the Cursor marketplace during the 11‑hour window is potentially compromised. This includes developers, sysadmins, and SecOps teams who rely on the extension for code generation or debugging.
Because the attack relies on local SSH service configuration, systems with permissive SSH settings or running as privileged users are at higher risk of successful remote access.
Impact
The primary impact is a persistent SSH backdoor that can be used for remote command execution, lateral movement, or data exfiltration. The attacker can also exfiltrate host details such as OS version, installed software, and network configuration.
In addition, the persistence mechanism can survive reboots and standard remediation attempts, making it harder to detect and remove without targeted hunting.
Exposure
Indicators include the presence of a new SSH key in the user’s authorized_keys file, unexpected SSH service restarts, and outbound connections to the attacker’s control server on non‑standard ports. The malicious JavaScript also writes a hidden file in the user’s home directory that records host metadata.
Key indicators:~/.ssh/authorized_keysadditions,/var/log/auth.logentries for reverse tunnels, and a hidden file named.clausext-backdoor.
What to do
Defenders should immediately inventory all machines that installed the affected extension. Preserve logs and disk images before removal to support forensic analysis.
Use the following actions to remediate:
- Remove the malicious extension package from the Cursor marketplace and uninstall it from all affected systems.
- Delete the attacker‑controlled SSH key from
authorized_keysand any related configuration files. - Stop and disable the local SSH service if it was enabled by the loader, then re‑enable it only after verifying configuration integrity.
- Revoke any SSH certificates or tokens that may have been issued during the incident.
- Run the Microsoft Defender XDR hunting queries provided in the advisory to locate persistence artifacts.
- Apply the latest security patches for the operating system and SSH daemon to mitigate known vulnerabilities.
What to watch
Monitor for repeated attempts to establish reverse SSH tunnels, especially from unfamiliar IP addresses or unusual ports. Watch for new SSH keys added to authorized_keys and for changes to SSH daemon configuration files.
Keep an eye on endpoint telemetry for unexplained outbound traffic and for processes that spawn SSH sessions without user interaction. Maintain a baseline of normal SSH activity to detect deviations quickly.
Related articles
Quasar Linux RAT: Rootkit, PAM Backdoor, Credential Harvesting in Supply-Chain Threat
TrendAI uncovered Quasar Linux (QLNX), a stealthy Linux RAT that embeds a kernel rootkit, a PAM backdoor, and credential‑harvesting modules. The malware evades most AV, enabling persistent root access in compromised supply chains. Defenders should audit PAM, scan for rootkits, and enforce strict supply‑chain controls.
Read briefing
BragJack: Malicious Extension Hijacks AI Browser Assistants
A proof‑of‑concept attack named BragJack demonstrates how a single malicious browser extension can hijack AI assistants in Chrome, Edge, Opera Neon, Perplexity Comet, and Claude in Chrome. The technique abuses browser‑level privileges, allowing the attacker to read data and act on the user’s behalf without interaction. Defenders should remove suspicious extensions, enforce strict extension policies, and keep browsers updated.
Read briefing
JS‑Sniffers 2 (G‑Analytics Family) – Underground Sale of Stolen Card Data
Group‑IB uncovered a new underground marketplace selling payment‑card data harvested by the JS‑Sniffers 2 threat actor. The malicious JavaScript injects into compromised sites, capturing card details before exfiltration. Defenders should scan for obfuscated scripts, enforce CSP, and audit third‑party code.
Read briefing
Malicious Ad‑Blocker Extension Disguised as CrashFix Leads to ModeloRAT Infection
A new campaign, CrashFix, distributes a fake ad‑blocker extension that intentionally crashes browsers before offering a bogus fix. The extension installs the ModeloRAT backdoor, targeting high‑value users. Defenders should block the extension, monitor for related process activity, and update endpoint detection rules.
Read briefing