security: Inside a malicious Claude Code-branded extension and its persistent SSH backdoor
Microsoft Security Blog
2026-10-31
Microsoft describes a malicious extension branded as Claude Code that installs a persistent SSH backdoor, and provides detection and remediation guidance. The post focuses on how the extension behaves and how to identify affected systems.