Fake Claude Code extension planted SSH backdoor on Cursor users

A tampered copy of the Claude Code extension was served through the Cursor extension marketplace for several hours on 29 October 2026, in what Microsoft describes as an attempted supply-chain attack on Cursor users. According to a Microsoft Security blog post published on 31 October 2026, Cursor reported that the malicious versions of the extension, published under the identifier anthropic.claude-code as versions 2.1.313 and 2.1.312, were live from roughly 2:27am to 1:35pm Pacific Daylight Time.

Microsoft said it had confirmed that the malicious packages were never published or distributed from the Microsoft Visual Studio Marketplace, and that the npm package @antropic-ai/claude-code was not affected. Anthropic confirmed to Microsoft that its own systems were not compromised and that it did not develop the malicious package posted in the Cursor marketplace. All evidence at the time of writing suggests the incident was limited to the Cursor marketplace, Microsoft said.

Microsoft Threat Intelligence analysed the JavaScript injected into the extension package. The injected function runs when the extension module loads, before the extension's expected code, and uses Node.js interfaces to read host information, modify files and run operating system commands. According to Microsoft's analysis, the loader first collects reconnaissance about the machine, then attempts to install an attacker-controlled SSH key, enable the local SSH service, open a reverse tunnel back to an attacker server, and write startup files so the connection is re-established after a reboot.

The reconnaissance step gathers the hostname, username, operating system, architecture, home directory, working directory and the global Git email address. It also scans environment variables for names containing strings such as KEY, TOKEN, SECRET, PASS, AWS or GCP, keeping up to forty matches. Microsoft stresses that a later callback transmits the names of those variables, not their values, so the code shows what categories of credentials may be present on a machine but does not by itself demonstrate that secrets were stolen.

Two separate SSH identities are used. The loader checks the user's authorized_keys file for a comment reading svc-telemetry and, if that marker is absent, appends an embedded Ed25519 public key, creating an access entry for whoever holds the matching private key. A second, separate private key is decoded and written to a hidden temporary file whose name is derived from the hostname and home directory, then passed to SSH to authenticate an outbound connection to a remote account named tunnel, which requests forwarding back to the workstation's SSH port.

Microsoft notes that the code suppresses command output and silently swallows errors, while the extension keeps working normally so users are not alerted. Whether remote access actually succeeded on any given machine depends on local privileges, SSH configuration and the attacker's server, the company said, but the loader may still have written keys and persistence files even where the tunnel failed. It also relies on components already embedded in the package and built-in system tools, rather than downloading a further executable.

Microsoft advised organisations to identify systems that installed or automatically updated to the affected version from the Cursor marketplace, preserve evidence, remove confirmed malicious artefacts, review endpoint and network telemetry, and rotate credentials or revoke sessions where an investigation indicates exposure. The post also lists detections, hunting queries, mapped MITRE ATT&CK techniques including Protocol Tunneling, and indicators of compromise for Microsoft Defender XDR customers.