On 30 October 2026, Microsoft reported on a malicious Claude Code-branded Cursor extension designed to establish persistent SSH access. For defenders, removing the extension does not establish that the workstation, or its access, is safe again.
Package removal, endpoint recovery and access revocation need separate evidence. The trade-off is deciding how much legitimate access to interrupt when malicious execution is established but credential exposure remains uncertain.
Microsoft says the malicious packages were not distributed through Microsoft Visual Studio Marketplace or the official Claude Code npm distribution. It also reports that Anthropic told Microsoft its systems were not compromised.
A tunnel is evidence, not a login#
The reported mechanism involves injected JavaScript running before normal extension initialisation, attempting to install an SSH authorisation key and establish an outbound reverse tunnel to the workstation's SSH service. Startup scripts maintain persistence independently of the extension. That independence is why I'd reject uninstalling the package as sufficient evidence of recovery.
Expel reported investigating four related incidents across four customers on 29–30 October 2026, each involving one Mac. In one incident, it found a running tunnel but no attacker authorisation key. It also observed an outbound tunnel connection on a Mac whose user was not an administrator.
Successful remote login still depends on privileges and SSH configuration, so an outbound connection cannot, on its own, establish authenticated access. My read is that investigators should record attempted setup, surviving artefacts and authenticated activity as different findings.
The distribution window is not the execution window#
According to Expel's incident account, one customer Mac first showed malicious activity at 04:45 UTC on 30 October 2026, approximately eight hours after distribution ended. Expel's plausible explanation is delayed execution following an earlier download, but the reviewed evidence does not confirm that download timeline. On that Mac, Expel observed the persistent tunnel connecting outward until 14:29 UTC on 30 October 2026.
The operational implication is straightforward: a search bounded only by the distribution period can miss later execution. I'd ask responders to explain their endpoint search window rather than inherit the package availability window by default.
Recovery needs an explicit access decision#
The credential evidence deserves equally careful wording. Microsoft's code analysis found reconnaissance reporting of up to 40 matching environment-variable names, not their secret values. That finding does not demonstrate that the reporting callback stole those secrets, and the reviewed evidence did not establish subsequent credential theft or lateral movement.
Microsoft recommends credential rotation and session revocation from a clean device when credential access is indicated or device trust cannot be restored. That is a conditional recovery decision, not a claim that every affected user had credentials stolen. I'd distinguish removing an unauthorised SSH authorisation entry from rotating legitimate credentials or revoking application sessions: each addresses a different part of recovery.
This week, take one endpoint incident closure record and check whether it separately evidences package removal, endpoint recovery and the access-revocation decision, including the justification for any credentials or sessions left active.