Microsoft analyzes malicious Claude Code-branded extension with persistent SSH backdoor
The Microsoft Security Blog has published an analysis of a malicious extension branded as Claude Code, which the post says includes a persistent SSH backdoor. The post also gives guidance on how to detect and remediate the threat. According to the URL, the extension is a Cursor extension, and the post is dated October 30, 2026. The snippet does not include further technical details, which are available in the full Microsoft post.
Why it matters: Developers who use AI coding tools should check whether a Claude Code-branded extension is installed on their machines, since a persistent backdoor can remain after initial use. Security teams should review Microsoft's detection and remediation steps and apply them where needed. Watch for further details on how the extension was distributed and which systems are affected.
AI-assisted summary based on listed sources.
Selected because it is one of the clearest source-backed signals in the current scan.