Malicious Claude Code Extension Served in Cursor Supply Chain Attack

Hi, what are you looking for?

The extension performed host reconnaissance and attempted to create a reverse SSH tunnel.

By

Flipboard

Reddit

Whatsapp

Whatsapp

Email

Cursor users have been targeted with malicious versions of Anthropic’s Claude Code extension in a new supply chain attack.The incident occurred on October 29 and involved versions 2.1.312 and 2.1.313 of theanthropic.claude-codeextension, which were live in the Cursor VS Code Extension Marketplace for roughly 11 hours.Aiming at both macOS and Windows users, the extension contained JavaScript code designed to run when modules were loaded to establish a reverse SSH tunnel.Roughly 5,000 developer systems might have downloaded the malicious versions, security researcher Kevin Beaumontnotes.The modified extension versions were not developed by Anthropic, and neither was pushed to the Microsoft Visual Studio Marketplace, Open VSX, or the NPM registry.“A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected, and this only impacts Cursor users,” Anthropic’s Felix Riesebergsaid.Advertisement. Scroll to continue reading.To avoid confusion, Anthropic updated its legitimate Claude Code extension directly to version 2.1.314.Cursor removed the modified Claude Code extension from the store immediately after identifying it and suspended the marketplace to investigate the incident. Cursor found no other malicious extensions, rotated all keys, and rebuilt and reopened the marketplace.Additionally, it worked with the cloud provider hosting the attacker’s server to take it offline.“We have no evidence that other versions of the extension or the official distribution are affected,”Cursor said.The modified extension versions contained a JavaScript function that was executed during module loading to collect host information, modify files, and run OS commands.“The loader first collects host reconnaissance. It then attempts to install an SSH key, enable SSH, create a reverse tunnel, and configure persistence. A delayed callback subsequently attempts to send host details,”Microsoftnotes.The code was observed collecting information such as hostname, username, OS, system architecture, working directory, and global Git email, as well as deploying platform-specific scripts and startup configurations for persistence.According to Cursor, because enabling the local SSH service requires admin rights and the extension does not have them on most macOS and Windows systems, the step failed, preventing the attackers from logging in through the tunnel.Users should remove the malicious extension versions as soon as possible. Cursor has released a script to help users detect infections, along with indicators of compromise (IoCs) to identify potential compromises across environments.“Isolate hosts showing evidence of payload execution or backdoor installation. Remove the unauthorized SSH key, persistence mechanisms, and running tunnel processes, and assess whether the host should be rebuilt. Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running,” Cursor notes.Related:LiteLLM Compromised in Fresh Supply Chain AttackRelated:Nobody Trusts the Security Questionnaire. We Rely on It Anyway.Related:AOMEI Backupper Compromised in Short-Burst Supply Chain CampaignRelated:Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack

The incident occurred on October 29 and involved versions 2.1.312 and 2.1.313 of theanthropic.claude-codeextension, which were live in the Cursor VS Code Extension Marketplace for roughly 11 hours.Aiming at both macOS and Windows users, the extension contained JavaScript code designed to run when modules were loaded to establish a reverse SSH tunnel.Roughly 5,000 developer systems might have downloaded the malicious versions, security researcher Kevin Beaumontnotes.The modified extension versions were not developed by Anthropic, and neither was pushed to the Microsoft Visual Studio Marketplace, Open VSX, or the NPM registry.“A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected, and this only impacts Cursor users,” Anthropic’s Felix Riesebergsaid.Advertisement. Scroll to continue reading.To avoid confusion, Anthropic updated its legitimate Claude Code extension directly to version 2.1.314.Cursor removed the modified Claude Code extension from the store immediately after identifying it and suspended the marketplace to investigate the incident. Cursor found no other malicious extensions, rotated all keys, and rebuilt and reopened the marketplace.Additionally, it worked with the cloud provider hosting the attacker’s server to take it offline.“We have no evidence that other versions of the extension or the official distribution are affected,”Cursor said.The modified extension versions contained a JavaScript function that was executed during module loading to collect host information, modify files, and run OS commands.“The loader first collects host reconnaissance. It then attempts to install an SSH key, enable SSH, create a reverse tunnel, and configure persistence. A delayed callback subsequently attempts to send host details,”Microsoftnotes.The code was observed collecting information such as hostname, username, OS, system architecture, working directory, and global Git email, as well as deploying platform-specific scripts and startup configurations for persistence.According to Cursor, because enabling the local SSH service requires admin rights and the extension does not have them on most macOS and Windows systems, the step failed, preventing the attackers from logging in through the tunnel.Users should remove the malicious extension versions as soon as possible. Cursor has released a script to help users detect infections, along with indicators of compromise (IoCs) to identify potential compromises across environments.“Isolate hosts showing evidence of payload execution or backdoor installation. Remove the unauthorized SSH key, persistence mechanisms, and running tunnel processes, and assess whether the host should be rebuilt. Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running,” Cursor notes.Related:LiteLLM Compromised in Fresh Supply Chain AttackRelated:Nobody Trusts the Security Questionnaire. We Rely on It Anyway.Related:AOMEI Backupper Compromised in Short-Burst Supply Chain CampaignRelated:Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack

Aiming at both macOS and Windows users, the extension contained JavaScript code designed to run when modules were loaded to establish a reverse SSH tunnel.Roughly 5,000 developer systems might have downloaded the malicious versions, security researcher Kevin Beaumontnotes.The modified extension versions were not developed by Anthropic, and neither was pushed to the Microsoft Visual Studio Marketplace, Open VSX, or the NPM registry.“A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected, and this only impacts Cursor users,” Anthropic’s Felix Riesebergsaid.Advertisement. Scroll to continue reading.To avoid confusion, Anthropic updated its legitimate Claude Code extension directly to version 2.1.314.Cursor removed the modified Claude Code extension from the store immediately after identifying it and suspended the marketplace to investigate the incident. Cursor found no other malicious extensions, rotated all keys, and rebuilt and reopened the marketplace.Additionally, it worked with the cloud provider hosting the attacker’s server to take it offline.“We have no evidence that other versions of the extension or the official distribution are affected,”Cursor said.The modified extension versions contained a JavaScript function that was executed during module loading to collect host information, modify files, and run OS commands.“The loader first collects host reconnaissance. It then attempts to install an SSH key, enable SSH, create a reverse tunnel, and configure persistence. A delayed callback subsequently attempts to send host details,”Microsoftnotes.The code was observed collecting information such as hostname, username, OS, system architecture, working directory, and global Git email, as well as deploying platform-specific scripts and startup configurations for persistence.According to Cursor, because enabling the local SSH service requires admin rights and the extension does not have them on most macOS and Windows systems, the step failed, preventing the attackers from logging in through the tunnel.Users should remove the malicious extension versions as soon as possible. Cursor has released a script to help users detect infections, along with indicators of compromise (IoCs) to identify potential compromises across environments.“Isolate hosts showing evidence of payload execution or backdoor installation. Remove the unauthorized SSH key, persistence mechanisms, and running tunnel processes, and assess whether the host should be rebuilt. Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running,” Cursor notes.Related:LiteLLM Compromised in Fresh Supply Chain AttackRelated:Nobody Trusts the Security Questionnaire. We Rely on It Anyway.Related:AOMEI Backupper Compromised in Short-Burst Supply Chain CampaignRelated:Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack

Roughly 5,000 developer systems might have downloaded the malicious versions, security researcher Kevin Beaumontnotes.The modified extension versions were not developed by Anthropic, and neither was pushed to the Microsoft Visual Studio Marketplace, Open VSX, or the NPM registry.“A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected, and this only impacts Cursor users,” Anthropic’s Felix Riesebergsaid.Advertisement. Scroll to continue reading.To avoid confusion, Anthropic updated its legitimate Claude Code extension directly to version 2.1.314.Cursor removed the modified Claude Code extension from the store immediately after identifying it and suspended the marketplace to investigate the incident. Cursor found no other malicious extensions, rotated all keys, and rebuilt and reopened the marketplace.Additionally, it worked with the cloud provider hosting the attacker’s server to take it offline.“We have no evidence that other versions of the extension or the official distribution are affected,”Cursor said.The modified extension versions contained a JavaScript function that was executed during module loading to collect host information, modify files, and run OS commands.“The loader first collects host reconnaissance. It then attempts to install an SSH key, enable SSH, create a reverse tunnel, and configure persistence. A delayed callback subsequently attempts to send host details,”Microsoftnotes.The code was observed collecting information such as hostname, username, OS, system architecture, working directory, and global Git email, as well as deploying platform-specific scripts and startup configurations for persistence.According to Cursor, because enabling the local SSH service requires admin rights and the extension does not have them on most macOS and Windows systems, the step failed, preventing the attackers from logging in through the tunnel.Users should remove the malicious extension versions as soon as possible. Cursor has released a script to help users detect infections, along with indicators of compromise (IoCs) to identify potential compromises across environments.“Isolate hosts showing evidence of payload execution or backdoor installation. Remove the unauthorized SSH key, persistence mechanisms, and running tunnel processes, and assess whether the host should be rebuilt. Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running,” Cursor notes.Related:LiteLLM Compromised in Fresh Supply Chain AttackRelated:Nobody Trusts the Security Questionnaire. We Rely on It Anyway.Related:AOMEI Backupper Compromised in Short-Burst Supply Chain CampaignRelated:Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack

The modified extension versions were not developed by Anthropic, and neither was pushed to the Microsoft Visual Studio Marketplace, Open VSX, or the NPM registry.“A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected, and this only impacts Cursor users,” Anthropic’s Felix Riesebergsaid.Advertisement. Scroll to continue reading.To avoid confusion, Anthropic updated its legitimate Claude Code extension directly to version 2.1.314.Cursor removed the modified Claude Code extension from the store immediately after identifying it and suspended the marketplace to investigate the incident. Cursor found no other malicious extensions, rotated all keys, and rebuilt and reopened the marketplace.Additionally, it worked with the cloud provider hosting the attacker’s server to take it offline.“We have no evidence that other versions of the extension or the official distribution are affected,”Cursor said.The modified extension versions contained a JavaScript function that was executed during module loading to collect host information, modify files, and run OS commands.“The loader first collects host reconnaissance. It then attempts to install an SSH key, enable SSH, create a reverse tunnel, and configure persistence. A delayed callback subsequently attempts to send host details,”Microsoftnotes.The code was observed collecting information such as hostname, username, OS, system architecture, working directory, and global Git email, as well as deploying platform-specific scripts and startup configurations for persistence.According to Cursor, because enabling the local SSH service requires admin rights and the extension does not have them on most macOS and Windows systems, the step failed, preventing the attackers from logging in through the tunnel.Users should remove the malicious extension versions as soon as possible. Cursor has released a script to help users detect infections, along with indicators of compromise (IoCs) to identify potential compromises across environments.“Isolate hosts showing evidence of payload execution or backdoor installation. Remove the unauthorized SSH key, persistence mechanisms, and running tunnel processes, and assess whether the host should be rebuilt. Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running,” Cursor notes.Related:LiteLLM Compromised in Fresh Supply Chain AttackRelated:Nobody Trusts the Security Questionnaire. We Rely on It Anyway.Related:AOMEI Backupper Compromised in Short-Burst Supply Chain CampaignRelated:Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack

“A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected, and this only impacts Cursor users,” Anthropic’s Felix Riesebergsaid.Advertisement. Scroll to continue reading.To avoid confusion, Anthropic updated its legitimate Claude Code extension directly to version 2.1.314.Cursor removed the modified Claude Code extension from the store immediately after identifying it and suspended the marketplace to investigate the incident. Cursor found no other malicious extensions, rotated all keys, and rebuilt and reopened the marketplace.Additionally, it worked with the cloud provider hosting the attacker’s server to take it offline.“We have no evidence that other versions of the extension or the official distribution are affected,”Cursor said.The modified extension versions contained a JavaScript function that was executed during module loading to collect host information, modify files, and run OS commands.“The loader first collects host reconnaissance. It then attempts to install an SSH key, enable SSH, create a reverse tunnel, and configure persistence. A delayed callback subsequently attempts to send host details,”Microsoftnotes.The code was observed collecting information such as hostname, username, OS, system architecture, working directory, and global Git email, as well as deploying platform-specific scripts and startup configurations for persistence.According to Cursor, because enabling the local SSH service requires admin rights and the extension does not have them on most macOS and Windows systems, the step failed, preventing the attackers from logging in through the tunnel.Users should remove the malicious extension versions as soon as possible. Cursor has released a script to help users detect infections, along with indicators of compromise (IoCs) to identify potential compromises across environments.“Isolate hosts showing evidence of payload execution or backdoor installation. Remove the unauthorized SSH key, persistence mechanisms, and running tunnel processes, and assess whether the host should be rebuilt. Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running,” Cursor notes.Related:LiteLLM Compromised in Fresh Supply Chain AttackRelated:Nobody Trusts the Security Questionnaire. We Rely on It Anyway.Related:AOMEI Backupper Compromised in Short-Burst Supply Chain CampaignRelated:Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack

To avoid confusion, Anthropic updated its legitimate Claude Code extension directly to version 2.1.314.Cursor removed the modified Claude Code extension from the store immediately after identifying it and suspended the marketplace to investigate the incident. Cursor found no other malicious extensions, rotated all keys, and rebuilt and reopened the marketplace.Additionally, it worked with the cloud provider hosting the attacker’s server to take it offline.“We have no evidence that other versions of the extension or the official distribution are affected,”Cursor said.The modified extension versions contained a JavaScript function that was executed during module loading to collect host information, modify files, and run OS commands.“The loader first collects host reconnaissance. It then attempts to install an SSH key, enable SSH, create a reverse tunnel, and configure persistence. A delayed callback subsequently attempts to send host details,”Microsoftnotes.The code was observed collecting information such as hostname, username, OS, system architecture, working directory, and global Git email, as well as deploying platform-specific scripts and startup configurations for persistence.According to Cursor, because enabling the local SSH service requires admin rights and the extension does not have them on most macOS and Windows systems, the step failed, preventing the attackers from logging in through the tunnel.Users should remove the malicious extension versions as soon as possible. Cursor has released a script to help users detect infections, along with indicators of compromise (IoCs) to identify potential compromises across environments.“Isolate hosts showing evidence of payload execution or backdoor installation. Remove the unauthorized SSH key, persistence mechanisms, and running tunnel processes, and assess whether the host should be rebuilt. Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running,” Cursor notes.Related:LiteLLM Compromised in Fresh Supply Chain AttackRelated:Nobody Trusts the Security Questionnaire. We Rely on It Anyway.Related:AOMEI Backupper Compromised in Short-Burst Supply Chain CampaignRelated:Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack

Cursor removed the modified Claude Code extension from the store immediately after identifying it and suspended the marketplace to investigate the incident. Cursor found no other malicious extensions, rotated all keys, and rebuilt and reopened the marketplace.Additionally, it worked with the cloud provider hosting the attacker’s server to take it offline.“We have no evidence that other versions of the extension or the official distribution are affected,”Cursor said.The modified extension versions contained a JavaScript function that was executed during module loading to collect host information, modify files, and run OS commands.“The loader first collects host reconnaissance. It then attempts to install an SSH key, enable SSH, create a reverse tunnel, and configure persistence. A delayed callback subsequently attempts to send host details,”Microsoftnotes.The code was observed collecting information such as hostname, username, OS, system architecture, working directory, and global Git email, as well as deploying platform-specific scripts and startup configurations for persistence.According to Cursor, because enabling the local SSH service requires admin rights and the extension does not have them on most macOS and Windows systems, the step failed, preventing the attackers from logging in through the tunnel.Users should remove the malicious extension versions as soon as possible. Cursor has released a script to help users detect infections, along with indicators of compromise (IoCs) to identify potential compromises across environments.“Isolate hosts showing evidence of payload execution or backdoor installation. Remove the unauthorized SSH key, persistence mechanisms, and running tunnel processes, and assess whether the host should be rebuilt. Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running,” Cursor notes.Related:LiteLLM Compromised in Fresh Supply Chain AttackRelated:Nobody Trusts the Security Questionnaire. We Rely on It Anyway.Related:AOMEI Backupper Compromised in Short-Burst Supply Chain CampaignRelated:Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack

Additionally, it worked with the cloud provider hosting the attacker’s server to take it offline.“We have no evidence that other versions of the extension or the official distribution are affected,”Cursor said.The modified extension versions contained a JavaScript function that was executed during module loading to collect host information, modify files, and run OS commands.“The loader first collects host reconnaissance. It then attempts to install an SSH key, enable SSH, create a reverse tunnel, and configure persistence. A delayed callback subsequently attempts to send host details,”Microsoftnotes.The code was observed collecting information such as hostname, username, OS, system architecture, working directory, and global Git email, as well as deploying platform-specific scripts and startup configurations for persistence.According to Cursor, because enabling the local SSH service requires admin rights and the extension does not have them on most macOS and Windows systems, the step failed, preventing the attackers from logging in through the tunnel.Users should remove the malicious extension versions as soon as possible. Cursor has released a script to help users detect infections, along with indicators of compromise (IoCs) to identify potential compromises across environments.“Isolate hosts showing evidence of payload execution or backdoor installation. Remove the unauthorized SSH key, persistence mechanisms, and running tunnel processes, and assess whether the host should be rebuilt. Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running,” Cursor notes.Related:LiteLLM Compromised in Fresh Supply Chain AttackRelated:Nobody Trusts the Security Questionnaire. We Rely on It Anyway.Related:AOMEI Backupper Compromised in Short-Burst Supply Chain CampaignRelated:Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack

“We have no evidence that other versions of the extension or the official distribution are affected,”Cursor said.The modified extension versions contained a JavaScript function that was executed during module loading to collect host information, modify files, and run OS commands.“The loader first collects host reconnaissance. It then attempts to install an SSH key, enable SSH, create a reverse tunnel, and configure persistence. A delayed callback subsequently attempts to send host details,”Microsoftnotes.The code was observed collecting information such as hostname, username, OS, system architecture, working directory, and global Git email, as well as deploying platform-specific scripts and startup configurations for persistence.According to Cursor, because enabling the local SSH service requires admin rights and the extension does not have them on most macOS and Windows systems, the step failed, preventing the attackers from logging in through the tunnel.Users should remove the malicious extension versions as soon as possible. Cursor has released a script to help users detect infections, along with indicators of compromise (IoCs) to identify potential compromises across environments.“Isolate hosts showing evidence of payload execution or backdoor installation. Remove the unauthorized SSH key, persistence mechanisms, and running tunnel processes, and assess whether the host should be rebuilt. Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running,” Cursor notes.Related:LiteLLM Compromised in Fresh Supply Chain AttackRelated:Nobody Trusts the Security Questionnaire. We Rely on It Anyway.Related:AOMEI Backupper Compromised in Short-Burst Supply Chain CampaignRelated:Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack

The modified extension versions contained a JavaScript function that was executed during module loading to collect host information, modify files, and run OS commands.“The loader first collects host reconnaissance. It then attempts to install an SSH key, enable SSH, create a reverse tunnel, and configure persistence. A delayed callback subsequently attempts to send host details,”Microsoftnotes.The code was observed collecting information such as hostname, username, OS, system architecture, working directory, and global Git email, as well as deploying platform-specific scripts and startup configurations for persistence.According to Cursor, because enabling the local SSH service requires admin rights and the extension does not have them on most macOS and Windows systems, the step failed, preventing the attackers from logging in through the tunnel.Users should remove the malicious extension versions as soon as possible. Cursor has released a script to help users detect infections, along with indicators of compromise (IoCs) to identify potential compromises across environments.“Isolate hosts showing evidence of payload execution or backdoor installation. Remove the unauthorized SSH key, persistence mechanisms, and running tunnel processes, and assess whether the host should be rebuilt. Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running,” Cursor notes.Related:LiteLLM Compromised in Fresh Supply Chain AttackRelated:Nobody Trusts the Security Questionnaire. We Rely on It Anyway.Related:AOMEI Backupper Compromised in Short-Burst Supply Chain CampaignRelated:Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack

“The loader first collects host reconnaissance. It then attempts to install an SSH key, enable SSH, create a reverse tunnel, and configure persistence. A delayed callback subsequently attempts to send host details,”Microsoftnotes.The code was observed collecting information such as hostname, username, OS, system architecture, working directory, and global Git email, as well as deploying platform-specific scripts and startup configurations for persistence.According to Cursor, because enabling the local SSH service requires admin rights and the extension does not have them on most macOS and Windows systems, the step failed, preventing the attackers from logging in through the tunnel.Users should remove the malicious extension versions as soon as possible. Cursor has released a script to help users detect infections, along with indicators of compromise (IoCs) to identify potential compromises across environments.“Isolate hosts showing evidence of payload execution or backdoor installation. Remove the unauthorized SSH key, persistence mechanisms, and running tunnel processes, and assess whether the host should be rebuilt. Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running,” Cursor notes.Related:LiteLLM Compromised in Fresh Supply Chain AttackRelated:Nobody Trusts the Security Questionnaire. We Rely on It Anyway.Related:AOMEI Backupper Compromised in Short-Burst Supply Chain CampaignRelated:Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack

The code was observed collecting information such as hostname, username, OS, system architecture, working directory, and global Git email, as well as deploying platform-specific scripts and startup configurations for persistence.According to Cursor, because enabling the local SSH service requires admin rights and the extension does not have them on most macOS and Windows systems, the step failed, preventing the attackers from logging in through the tunnel.Users should remove the malicious extension versions as soon as possible. Cursor has released a script to help users detect infections, along with indicators of compromise (IoCs) to identify potential compromises across environments.“Isolate hosts showing evidence of payload execution or backdoor installation. Remove the unauthorized SSH key, persistence mechanisms, and running tunnel processes, and assess whether the host should be rebuilt. Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running,” Cursor notes.Related:LiteLLM Compromised in Fresh Supply Chain AttackRelated:Nobody Trusts the Security Questionnaire. We Rely on It Anyway.Related:AOMEI Backupper Compromised in Short-Burst Supply Chain CampaignRelated:Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack

According to Cursor, because enabling the local SSH service requires admin rights and the extension does not have them on most macOS and Windows systems, the step failed, preventing the attackers from logging in through the tunnel.Users should remove the malicious extension versions as soon as possible. Cursor has released a script to help users detect infections, along with indicators of compromise (IoCs) to identify potential compromises across environments.“Isolate hosts showing evidence of payload execution or backdoor installation. Remove the unauthorized SSH key, persistence mechanisms, and running tunnel processes, and assess whether the host should be rebuilt. Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running,” Cursor notes.Related:LiteLLM Compromised in Fresh Supply Chain AttackRelated:Nobody Trusts the Security Questionnaire. We Rely on It Anyway.Related:AOMEI Backupper Compromised in Short-Burst Supply Chain CampaignRelated:Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack

Users should remove the malicious extension versions as soon as possible. Cursor has released a script to help users detect infections, along with indicators of compromise (IoCs) to identify potential compromises across environments.“Isolate hosts showing evidence of payload execution or backdoor installation. Remove the unauthorized SSH key, persistence mechanisms, and running tunnel processes, and assess whether the host should be rebuilt. Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running,” Cursor notes.Related:LiteLLM Compromised in Fresh Supply Chain AttackRelated:Nobody Trusts the Security Questionnaire. We Rely on It Anyway.Related:AOMEI Backupper Compromised in Short-Burst Supply Chain CampaignRelated:Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack

“Isolate hosts showing evidence of payload execution or backdoor installation. Remove the unauthorized SSH key, persistence mechanisms, and running tunnel processes, and assess whether the host should be rebuilt. Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running,” Cursor notes.Related:LiteLLM Compromised in Fresh Supply Chain AttackRelated:Nobody Trusts the Security Questionnaire. We Rely on It Anyway.Related:AOMEI Backupper Compromised in Short-Burst Supply Chain CampaignRelated:Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack

Related:LiteLLM Compromised in Fresh Supply Chain AttackRelated:Nobody Trusts the Security Questionnaire. We Rely on It Anyway.Related:AOMEI Backupper Compromised in Short-Burst Supply Chain CampaignRelated:Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack

Related:Nobody Trusts the Security Questionnaire. We Rely on It Anyway.Related:AOMEI Backupper Compromised in Short-Burst Supply Chain CampaignRelated:Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack

Related:AOMEI Backupper Compromised in Short-Burst Supply Chain CampaignRelated:Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack

Related:Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack

Ionut Arghire is an international correspondent for SecurityWeek.

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program.

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Barracuda has appointed Dan Fletcher as CFO.

Artemis Security has appointed Arun Singh as CGO.

General Paul M. Nakasone has joined Armadin’s Board of Directors.

As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.(Torsten George)

Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.(Steve Durbin)

The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)

Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)

Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)

Flipboard

Reddit

Whatsapp

Whatsapp

Email

Got a confidential news tip? We want to hear from you.

Reach a large audience of enterprise cybersecurity professionals

Subscribe to the SecurityWeek Daily Briefing and get the latest content delivered to your inbox.

Copyright © 2026 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved.