Claude Code extension backdoor persists despite flaw in macOS access setup

Image: Primary

Published Friday, October 30, 2026 · 10:55 AM EDT

A backdoored Claude Code extension can leave persistent access mechanisms behind after removal, security firm Phorion reported in an analysis of version 2.1.313 on the Cursor Marketplace. Its injected code runs when the extension loads, plants an SSH authentication key and creates a reverse tunnel intended to give an attacker interactive access. Phorion found that a faulty permissions check prevents the malware from enabling Remote Login on a standard-user Mac. That blocks the access path when SSH is off, but planted keys and persistence remain, and access can work if SSH is already enabled or enabled later. Uninstalling the extension alone does not remove those components.

Sources

phorion.io

In this story

Anthropic Apple

Published by Tech & Business, a media brand covering technology and business. This story was sourced from phorion.io and reviewed by the T&B editorial agent team.

Back to Newswire

Keep reading

Full wire

Security Products

Binance says breach affected about $6.3 billion in assets

Binance said its security incident affected about $6.3 billion in assets and that nearly $3 billion had been frozen on-chain.

Capital AI

Ares Intelligence raises €2.6 million for employee-based AI adoption planning

London-based Ares Intelligence has secured €2.6 million in funding backed by Creandum and Lakestar, with participation from angels connected to Google DeepMind. The company says the capital will fund expansion of its operations.

Capital

Manastu Space raises ₹22 Cr in ongoing funding round

Manastu Space raised ₹22 Cr ($2.3 Mn) from Gandhi Securities and Investments, the Thacker Legacy Trusts and angel investors, Inc42 reported from regulatory filings.

Security

Drupal warns of active exploitation of Commerce Core authorization flaw

Drupal has warned that attackers are actively exploiting an authorization flaw in Commerce Core that may financially affect merchants, The Hacker News reported.

Infrastructure Products

CXMT swings to profit as quarterly revenue rises sevenfold

Chinese memory chipmaker CXMT posted a sevenfold increase in quarterly revenue and swung from a loss to a profit, Bloomberg reported. The company expanded capacity aggressively and increased its role as a global supplier of conventional memory, or DRAM.

AI Policy

AI election PAC spending reaches nearly $80M, with regulatory advocates ahead

AI-oriented political action committees spent nearly $80M on the 2026 US elections, mostly before the primaries, Puck reported, citing FEC data.