TI Mindmap HUB
Threat Intelligence Report

Malicious Claude Code extension distributed through Cursor marketplace

📅 October 31, 2026 📰 www.sophos.com 🔍 0 CVE(s) referenced

A malicious Claude Code extension in Cursor’s marketplace exposed up to 5,000 macOS and Windows users to an SSH backdoor, reverse tunnel, persistence, and credential theft risk requiring manual remediation beyond uninstalling the extension.

vendor

Sign in to access the full report including:
detailed analysis, IOCs, MITRE ATT&CK mapping, and STIX bundle.

🔐 Sign In to Read Full Report

You'll need to accept our Terms of Service to access the platform.

📊 Visual Mindmap
🎯 IOC Extraction
⚔️ MITRE ATT&CK TTPs
📦 STIX 2.1 Bundle