Official Claude Code Extension Compromise: Security Advisory
Summary
Phorion discloses a backdoor in the official Claude Code for VS Code extension on Cursor Marketplace. The backdoor installs a persistent SSH access mechanism across macOS, Linux, and Windows, with a focus on macOS persistence via a LaunchAgent and a reverse SSH tunnel to an attacker-controlled server. The article details the infection chain, persistence techniques, host reconnaissance, beacons, indicators, and remediation steps.