Backdoor in Claude Code for VS Code extension on the Cursor Marketplace
Phorion detected a backdoor in the official Claude Code for VS Code extension on the Cursor Marketplace, which drops a persistent SSH backdoor across macOS, Linux, and Windows.
Key points
- •A backdoor was detected in the official Claude Code for VS Code extension bundle distributed on the Cursor Marketplace.
- •The backdoor deploys a persistent SSH backdoor across macOS, Linux, and Windows systems.
- •The incident was detected by Phorion, with a detailed technical write-up provided.