Malicious Claude Code Cursor Extension: Hunt the SSH Backdoor
A malicious Claude Code-branded extension from the Cursor Marketplace attempted persistent SSH access. Learn how to scope exposure, preserve evidence, hunt indicators, remediate endpoints, and validate recovery.