Source Transparency
Microsoft Security Blog
Recent VQV signals collected from this public source, grouped with the topics where it appears.
Source health details are not available for this source yet. Recent signal count and last seen time are shown from public findings.
Recent Signals
All sources
BIG MOVE · SOURCE-BACKED
95% signal strength
Microsoft analyzes malicious Claude Code-branded extension with persistent SSH backdoor
The Microsoft Security Blog has published an analysis of a malicious extension branded as Claude Code, which the post says includes a persistent SSH backdoor. The post also gives guidance on how to detect and remediate the threat. According to the URL, the extension is a Cursor extension, and the post is dated October 30, 2026. The snippet does not include further technical details, which are available in the full Microsoft post.
Why it matters: Developers who use AI coding tools should check whether a Claude Code-branded extension is installed on their machines, since a persistent backdoor can remain after initial use. Security teams should review Microsoft's detection and remediation steps and apply them where needed. Watch for further details on how the extension was distributed and which systems are affected.
Why this is here: This signal is recent, source-backed, and connected to activity readers are already following in AI Coding Tools.