NewsThe Hacker News
Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor
More on Marketplace
Other advisories
- MediumCVE-2026-120849WC Lovers WCFM Marketplace: fehlende Autorisierung
- MediumCVE-2026-120848WC Lovers WCFM Marketplace: Cross-Site-Scripting (XSS)
- MediumCVE-2026-120849WC Lovers WCFM Marketplace: fehlende Autorisierung
- MediumCVE-2026-120848WC Lovers WCFM Marketplace: Cross-Site-Scripting (XSS)
- HighCVE-2026-62000WC Lovers WCFM Marketplace: fehlende Autorisierung
- HighCVE-2026-62000WC Lovers WCFM Marketplace: fehlende Autorisierung
- Criticalpwn_watch:claude-code-vscode-extension-ssh-backdoor-oct-2026Trojanized Claude Code VS Code extension (Anthropic.claude-code 2.1.312 and 2.1.313) in Cursor's extension marketplace planted an SSH backdoor on up to 5,000 machines
- MediumCVE-2026-72528CREEMA "Handmade Marketplace App - Creema" for Android: Open Redirect
Other news entries
- Cursor removes malicious Claude Code extension after SSH backdoor attemptNewsCSO Online
- Malicious Claude Code extension on Cursor planted SSH backdoorsNewsBleepingComputer
- Malicious Claude Code extension distributed through Cursor marketplaceNewsSophos X-Ops
- 10 most powerful cybersecurity companies todayNewsCSO Online
- As phishing-as-a-service goes industrial, Microsoft takes down a marketplace behind 1 billion messagesNewsCSO Online
- Yam Store: The Phishing Network Behind a Billion MessagesNewsDark Reading
- The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrimeNewsMicrosoft Threat Intelligence
- Owner of Empire cybercrime market gets 40 years in prisonNewsBleepingComputer
Source: https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html
ID