The Cursor Extension Hack That Silently Opened SSH Backdoors

Robert Moore · 2026-10-30

Imagine this: you're a developer, sipping your coffee, and you install what looks like a legit extension for Claude Code on Cursor. Everything seems fine. But within hours, your machine could be quietly compromised. That's exactly what happened on October 29 when a malicious version of Anthropic's Claude Code VS Code extension slipped through Cursor's marketplace for about 11 hours. Up to 5,000 developers were exposed to malware designed to install persistent SSH backdoors. ### What exactly went down? Someone managed to upload a tampered version of the Claude Code extension to Cursor's marketplace. For 11 hours, it was available for download. The extension looked normal but contained code that would quietly open an SSH backdoor on the developer's machine. That means attackers could remotely access the system without the user ever knowing. ### How did this happen? Cursor's marketplace, like many others, relies on a review process to catch malicious packages. But clearly, something slipped through. It's a reminder that even trusted platforms can have gaps. The extension was reportedly pulled after the issue was discovered, but by then, thousands had potentially downloaded it. ### What can you do to protect yourself? First, don't panic. But do take action. Here are a few practical steps: - **Audit your extensions**: Go through your installed extensions and remove anything you don't absolutely need. Check for updates and verify publishers. - **Monitor your SSH connections**: Look for unusual outbound connections, especially on port 22. Tools like `lsof` or `netstat` can help. - **Use antidetect browsers**: If you're managing multiple accounts or sensitive environments, antidetect browsers can help isolate sessions and reduce the risk of cross-contamination. They're not a silver bullet, but they add a layer of defense. - **Enable two-factor authentication**: Everywhere possible. It won't stop a backdoor, but it limits lateral movement. - **Keep your systems updated**: Patches often fix vulnerabilities that malware exploits. > "The reality is, supply chain attacks are on the rise, and developers are prime targets because they have access to so much." – Robert Moore, Lead Antidetect Browser Specialist ### Why this matters for antidetect browser users If you're using antidetect browsers to manage multiple profiles, you're already thinking about privacy and security. But remember, your browser is just one part of the puzzle. A compromised extension can bypass many browser-level protections. That's why it's crucial to vet every piece of software you install, even from seemingly reputable sources. ### The bigger picture This incident highlights a growing trend: attackers are targeting developer tools because they often have broad permissions. As developers, we need to be vigilant. Don't assume that because an extension is on a popular marketplace, it's safe. Always check the publisher, read reviews, and monitor for suspicious activity. So, the next time you go to install that handy extension, take a moment. Ask yourself: is this worth the risk? Because in the world of software supply chains, trust is a luxury you can't always afford.