Our takeCorrupted Claude Code extensions distributed via Cursor installed SSH backdoors on developers' machines, with up to 5,000 potentially affected. Microsoft and Phorion confirm the incident and advise checking for unauthorized access. If you use Cursor or self-host developer tools, audit your environment now.Security Resilience desk
What this means for you — Security leader:Review and remove any Claude Code or Cursor marketplace extensions; scan developer endpoints for anomalous SSH keys or persistence files using the Microsoft and Phorion guidance.
What this means for you — Lean IT orgs:Check every developer machine for suspicious Cursor or Claude Code extensions and remove them; follow the free detection steps from Microsoft if you run Windows or macOS.
What this means for you — MSP:Audit all managed developer endpoints and Cursor workspaces for the malicious Claude Code extensions; deploy the published detection rules and remove any planted SSH persistence files across client estates.
What this means for you — Researcher:Examine the tampered extension packages and any associated persistence mechanisms; cross-reference with the published IOCs from Microsoft and Phorion.