Malicious Claude Code clone on Cursor marketplace delivered SSH backdoor to 5,000+ developers

What happened

A counterfeit version of Anthropic's Claude Code extension appeared on the Cursor marketplace on October 29, 2026, and stayed online for roughly 11 hours before removal, according to a supply-chain alert published on dev.to. In that window it accumulated more than 5,000 downloads, meaning thousands of developers may have installed malware alongside their IDE tooling.

Cursor has since removed the extension, but anyone who installed a Claude-related extension during the exposure window should treat their machine as potentially compromised, the post warns.

How the attack worked

The fake listing copied the branding of Anthropic's official Claude Code tool but shipped under a different publisher ID, the sort of detail that is easy to miss in a marketplace search result. Once installed, it dropped a payload that created a persistent SSH backdoor, which according to the dev.to post, citing a Phorion report, gives an attacker ongoing remote access to the victim's development environment.

A persistent SSH backdoor is a serious foothold: it survives reboots and lets the operator return at will, on a machine that typically holds source repositories, access tokens and cloud credentials.

How to check whether you were affected

The dev.to alert lays out a short response checklist for Cursor users:

• Audit installed extensions in the Cursor sidebar and verify the publisher of every Claude-related tool.
• Inspect the ~/.ssh/authorized_keys file and delete any entries you do not recognise.
• Rotate GitHub tokens, AWS keys and any other stored secrets.
• Watch for unexpected outbound SSH connections or traffic to unknown IP addresses.

Part of a growing pattern

The incident did not come out of nowhere. The same post describes a related campaign in which a fake Solana starter-kit repository on GitHub was engineered to trick AI-assisted coding agents into pulling down the NetSupport remote access trojan. Separately, Bleeping Computer has reported a resurgence of crypto-mining malware on Hugging Face, spread through malicious models that hijack GPU capacity for cryptocurrency mining.

Taken together, these campaigns point at a shift in targeting: attackers have realised that AI-era development workflows, from one-click marketplace installs to agent-driven repository cloning and model downloads, are rich distribution channels with relatively weak verification.

Why it matters

Developers are high-value targets, and this attack shows how little friction stands between a well-branded fake and thousands of installs. A cloned name, a plausible listing and half a day of availability were enough to reach a large population of machines, and the publisher-ID mismatch that gave the clone away is not something most users check before clicking install.

The timing also matters. As AI agents write and execute code with growing autonomy, the pathways from a single malicious artifact to a running backdoor multiply, a trend the dev.to post frames as expanding the surface for prompt-to-malware and agent-to-backdoor techniques. For teams, the practical takeaway is procedural: verify publisher identities on marketplace installs, treat any Claude-related extension installed on October 29 with suspicion, and make SSH key inspection and credential rotation a routine security step rather than an emergency measure.