Malicious Claude Code extension on Cursor plants SSH backdoors

It attempts to install a persistent SSH backdoor and collect system data, including user email and public IP. Due to coding errors, SSH setup fails on both Windows and macOS, preventing remote access. The malware still transmits reconnaissance data to 134.209.82.225 without directly stealing credentials.

Summarised from the original article by an open-source model, then checked automatically: every number and English name must appear in the source. The original article is authoritative.