Introduction

Microsoft has published new research into a malicious Claude Code-branded extension briefly hosted in the Cursor marketplace on October 29, 2026. For security teams and administrators, this matters because the tampered package attempted to create persistent SSH-based remote access while continuing to appear functional to the user.

Importantly, Microsoft says the incident was not tied to Visual Studio Marketplace or the npm @antropic-ai/claude-code package, and current evidence indicates the exposure was limited to the Cursor marketplace.

What happened

According to Microsoft Security Research, the malicious versions were:

• anthropic.claude-code versions 2.1.312 and 2.1.313
• Available in the Cursor marketplace for a limited window on October 29, 2026
• Designed to run injected JavaScript before the extension’s expected code

What the malicious extension did

Microsoft’s analysis found the extension attempted to:

• Collect host and user reconnaissance data
• Append an attacker-controlled SSH public key to authorized_keys
• Enable the local SSH service
• Create reverse SSH forwarding to expose the local machine through an outbound tunnel
• Establish platform-specific persistence on Windows, macOS, and Linux
• Report host details and selected environment-variable names back to the attacker

The malware used built-in tools and embedded components rather than downloading another payload, which can make detection harder. It also suppressed command output and silently handled errors to avoid drawing attention.

Why this matters for IT and security teams

Even if the reverse tunnel did not succeed, the extension may still have:

• Written SSH authorization keys
• Created persistence artifacts
• Collected system metadata
• Left behind files or scheduled startup mechanisms

That means administrators should not assume failed attacker access simply because no active SSH session is visible. Systems that installed or auto-updated to the affected versions should be treated as potentially compromised until investigated.

Recommended actions

Microsoft recommends organizations take these steps:

• Identify endpoints that installed the affected Cursor marketplace extension versions
• Preserve forensic evidence before cleanup
• Remove confirmed malicious keys, scripts, and persistence artifacts
• Review endpoint and network telemetry for SSH tunneling or suspicious process activity
• Rotate credentials or revoke sessions where investigation suggests exposure
• Use Microsoft Defender XDR detections, threat analytics, and advanced hunting guidance once available and validated

Bottom line

This incident is a strong reminder that extension marketplaces can become a supply-chain risk. If your organization uses Cursor, security teams should immediately verify whether any devices received the malicious Claude Code extension and begin containment and remediation where needed.