A Fake Claude Code Extension Planted an SSH Backdoor....

If your business pays someone to build or maintain its software, check what they've installed on their laptop this week. On October 30, Microsoft published a write-up of a malicious extension branded as "Claude Code" for the Cursor code editor. It installs a persistent SSH backdoor, which is a way for an attacker to log back into the machine whenever they like. A separate campaign uses fake ChatGPT and Claude installers to hide a crypto miner.

The reason an owner should care is simple. The person who builds your website, your store integrations or your warehouse scripts usually has your hosting login, your payment API key and your code repository saved on their machine. If an AI-branded tool they grabbed in a hurry is fake, all of that is exposed. And this isn't only about developer hygiene. It's about whose laptop holds the keys to your business.

The same news cycle carries a second, duller job. Government-flagged exploited flaws in GitLab, Cisco ASA/FTD firewalls, the Linux kernel and VMware have patch deadlines of October 31 and November 1. If you self-host any of those, or your IT contractor does, the paperwork needs to land this week.

What happened

The facts, with the original sources. The analysis below comes from Apprised.news desk briefs, which are AI-written summaries of public reporting. The relevant one is the tech and cyber desk brief for 2026-10-31. Check the original sources before acting.

The fake Claude Code extension. Microsoft's security blog details a malicious Claude Code-branded extension for Cursor that sets up a persistent SSH backdoor. Dark Reading separately reports on the same kind of trojanized extension aimed at developers.
Fake installers. Check Point's "Yoba" campaign uses fake ChatGPT and Claude installers. Security Affairs describes it as hiding a crypto miner behind legitimate OpenAI and Anthropic binaries.
The desk's read. Two analysts on the Apprised tech desk (Cipher Desk and The Exfiltration Desk) agree these developer-tooling intrusions exploit borrowed brand trust, and that they are the more consequential security thread than the headline Binance breach.
What's still unknown. The Exfiltration Desk reads the extension campaign mainly as an intellectual-property and credential exposure event. Whether source code or credentials were actually taken is an open question until victims disclose.
The patch deadlines. The desk lists exploited flaws in GitLab, Cisco ASA/FTD, the Linux kernel and VMware that need patching on the stated dates: CVE-2026-46300 (Linux kernel) due October 31, and CVE-2026-97229 (GitLab) and CVE-2026-76418 (Cisco ASA/FTD) due November 1. BleepingComputer separately reports a critical Linux kernel flaw that allows remote root attacks on MPTCP servers. I haven't matched that article to a specific CVE number above, so confirm which one applies to your kernel.
How firm this is. The desk's weighted read is that the firm conclusions are narrow. The listed flaws are being exploited and need patching. Attribution, actual IP loss and any AI-authored offense are still open. I'll stay inside that line.

What it means for a small business

Who's exposed? Anyone whose software is touched by a person or a server that could be running one of these tools or products. That's most small businesses with a website, and it hits agencies and ecommerce shops with custom code hardest. Three hypothetical examples, with the arithmetic.

A 6-person ecommerce shop and its freelancer

The shop pays a freelance developer $75 an hour. They work about 12 hours a month, so the shop spends $900 a month on them. Their laptop also holds the store admin logins and a payment-processor API key. If a fake extension gave an attacker a persistent SSH backdoor on that laptop, the shop's exposure is every credential on it.

Say there are 8 keys and passwords to rotate. Rotating them takes about 2 hours, which is $150 of freelancer time. Compare that with one month of fraudulent orders and chargeback cleanup. Even a modest 40 bad orders at $60 each is $2,400 before you count payment-processor fees and your own time. The $150 is the cheap side of that trade.

A 40-person distributor with a firewall and a GitLab server

This company runs a Cisco ASA/FTD firewall and a self-hosted GitLab that holds its warehouse-integration code. Both have a November 1 deadline. The IT contractor bills 3 hours for patching and verification at $140 an hour, so $420. They also schedule a 30-minute maintenance window before the weekend.

The comparison is two days of downtime for 40 staff. If the average loaded cost is $200 a day per person, that's 40 x 2 x $200 = $16,000 in lost working time, before missed shipments. $420 against $16,000 isn't a close call. The catch is that someone has to actually confirm the patch landed, not just say it did.

A 12-person marketing agency with a free-for-all on installs

Each designer and developer installs their own AI helpers. The owner counts 9 installed AI-branded extensions or desktop apps across 12 laptops. Only 5 can be traced to an official publisher page. They remove the other 4 and require installs from a short approved list.

The audit is one hour per machine, so 12 person-hours across 12 laptops. At an internal cost of $50 an hour that's $600. It's tedious. It's also the only way to know whether a fake is already in the building, and 4 of 9 unverifiable is a high enough ratio to justify the afternoon.

What to do this week

Make a list of every AI coding tool, editor extension and AI desktop app installed by you, your developers and your freelancers. Include Cursor, VS Code, ChatGPT, Claude, and anything else carrying those brand names. A shared spreadsheet is fine. The kit below has a worksheet.
Verify each item's publisher against the vendor's own website or the official marketplace listing, not a search ad or a link in a message. Remove anything you can't verify. If you're not sure, remove it and reinstall from the vendor's own page.
Treat any laptop with an unfamiliar Claude Code-branded extension in Cursor as exposed. Check the SSH authorized_keys file and recent logins, then have your IT person review or rebuild the machine. Look for keys nobody can account for.
Rotate credentials on any developer machine you're unsure about: cloud keys, payment API keys, hosting logins, GitHub or GitLab tokens. Use a password manager to track what you changed. Rotate from a clean device, not the suspect laptop.
Ask your IT provider or host in writing whether you run GitLab, Cisco ASA/FTD, VMware or exposed Linux servers, and get confirmation that the October 31 and November 1 fixes are applied. "We'll look into it" isn't confirmation.
Don't run the Linux kernel update blindly in production. Schedule a short window, snapshot or back up first, and reboot to load the new kernel. A patched package that hasn't been rebooted into isn't protecting you.
Set a simple rule. AI tools get installed only from the vendor's official site or an approved internal list, and any new install gets a second pair of eyes. If your AI tooling sprawls, the AI Terminal Kickstart shows a clean, known-good setup to compare against.
Put it in contracts. Freelancers and agencies must keep client credentials off personal machines and report suspected compromises within 24 hours.

If you want a quick outside view of how your own site presents to AI crawlers while you're auditing, the AI crawler access auditor is free. It won't find a backdoor, so don't mistake it for a security scan.

Copy-paste prompts

Each prompt asks the AI to work from your own documents and to say when it's unsure. Replace the bracketed parts.

Use this to get a written install policy you can hand to staff and freelancers:

I run a small business with [number] people and [number] freelancers who touch our website code. Using only the details I give you here and the policy notes I paste below, write a one-page policy on which AI coding extensions and AI desktop apps may be installed, how to verify the publisher, and who approves new ones. Plain language, no jargon. If you are unsure about any technical step, say so instead of guessing.

Our current practices and notes: [paste notes]

Use this when you have an inventory and need to know what each item should be and who should publish it:

Here is a list of editor extensions and apps installed on our team's laptops, copied from the machines themselves: [paste list]. For each one, tell me what it normally is, who the legitimate publisher should be, and what I should check to confirm this is the real one. Flag anything that looks like a fake AI brand. If you do not recognise an item or are not sure of its publisher, say "unsure" and tell me how to check rather than guessing.

Use this the moment someone says they installed a Claude Code-branded extension from an unfamiliar publisher:

A developer on my team installed a Claude Code-branded extension in Cursor and we are not sure it was the official one. Using the details I paste below about their operating system and what they have stored on the machine, give me a step-by-step checklist a non-expert and their IT person can follow to check for a persistent SSH backdoor, and tell me which credentials to rotate first. Cover Mac, Windows and Linux as needed. Where a step depends on something you cannot know, say so.

Operating system and what is stored on the machine: [paste details]

Use this to get a written patch status out of your IT provider before the weekend:

Write an email to my IT provider asking them to confirm in writing, by Monday, whether we run GitLab, Cisco ASA/FTD, VMware or Linux servers affected by exploited vulnerabilities with CISA deadlines of October 31 and November 1, and what patch status and downtime to expect. Base it on the asset list I paste below. If the list is missing anything you would need to ask, put those questions in the email.

Our systems list: [paste list]

Use this to add a security clause to freelancer contracts, then have your lawyer read it:

Draft a short contract clause for freelance developers that requires them to keep our credentials off personal devices, install tools only from official publishers, and notify us within 24 hours of a suspected compromise. Use the wording of my existing contract below so it fits. Mark anything where you are unsure of the legal effect so I can ask a lawyer.

Existing contract text: [paste text]

Download the kit

The Developer Tool Lockdown Kit is a printable checklist set. It has an AI tool and extension inventory worksheet, a compromised-laptop response checklist, a patch confirmation email template, an approved tools policy template, a freelancer security clause and the prompts above. Grab it here: fake-claude-code-cursor-extension-check-kit.md.

Fact-check notes and sources

Apprised tech desk analysis: the source for the analyst agreement, the open questions on IP loss, and the KEV deadlines and CVE numbers. Apprised.news tech desk, 2026-10-31
Microsoft Security blog: describes the malicious Claude Code-branded Cursor extension and its persistent SSH backdoor. Microsoft
Dark Reading: separate reporting on the trojanized Claude Code extension for Cursor. Dark Reading
Security Affairs: describes the Yoba campaign hiding a crypto miner behind legitimate OpenAI and Anthropic binaries. Security Affairs
BleepingComputer: reports a critical Linux kernel flaw allowing remote root attacks on MPTCP servers. BleepingComputer
Not established: whether source code or credentials were actually stolen in the extension campaign, and who is behind it. The desk lists both as open.
Worked examples: all three are hypothetical, with round numbers chosen to show the arithmetic.

A Fake Claude Code Extension Planted an SSH Backdoor. Check Your Dev Tools