BreakingCyber Security
Supply chain attack delivers persistent SSH backdoors via malicious Cursor extension
A tampered version of the 'Claude Code' extension was distributed through the Cursor extension marketplace, allowing attackers to install persistent SSH reverse tunnels on developer machines. The malware, active for several hours on October 29, 2026, attempted to steal environment configuration metadata and create unauthorized remote access points.