A malicious extension disguised as a legitimate AI coding tool was recently discovered planting SSH backdoors on developers' machines through the Cursor editor. If your business employs developers, uses any AI-assisted coding tools, or lets staff install their own software extensions, this attack should be on your radar. Malicious VS Code extensions and similar plugins have quietly become one of the most effective ways attackers get inside small and medium-sized businesses — precisely because they look completely harmless.
What Actually Happened and Why It Matters
The attack worked by mimicking a well-known tool called Claude Code, which is a legitimate AI coding assistant. Someone published a fake version of it to the Cursor editor's extension marketplace. When developers installed it, the extension quietly set up an SSH backdoor — essentially a hidden, permanent doorway into the machine that the attacker could use at any time, even after the extension was removed.
What makes this particularly dangerous is the trust users place in official-looking marketplaces. Most people assume that if something is listed in a recognised software store, it has been vetted. That assumption is wrong, and attackers know it. Extension marketplaces — whether for browsers, code editors, or productivity tools — are frequently targeted because the review process is often minimal and the potential audience is enormous.
For SMBs, this matters beyond the technical detail. A backdoored developer machine is a direct line into your codebase, your internal systems, your customer data, and potentially your cloud infrastructure. One compromised laptop can unravel months of security work.
How SSH Backdoors Are Used Against Businesses
An SSH backdoor gives an attacker persistent, authenticated access to a system. SSH — Secure Shell — is a standard protocol used by developers and IT staff to connect to servers and remote machines. Legitimate use of SSH is everywhere. That is exactly what makes a backdoor built on it so difficult to detect.
Once an attacker has that access, they can move quietly through your network, exfiltrate source code, harvest credentials stored on the machine, or deploy ransomware at a time of their choosing. They rarely act immediately. In many cases, compromised access is sold on dark web markets and used weeks or months later by a completely different threat actor. By the time damage appears, the original point of entry is long forgotten.
This is a pattern Breachrr monitors closely. Stolen credentials and active access listings from compromised machines regularly surface in infostealer dumps and dark web forums before the affected business has any idea something went wrong.
What SMBs Should Do Right Now
The response does not require an enterprise security budget. It requires consistent habits and the right visibility.
First, audit every extension and plugin installed across your team's machines. This includes browser extensions, code editor plugins, and any productivity add-ons. Remove anything that is not actively needed or cannot be verified as legitimate. Establish a policy that new tools require approval before installation — even free ones from well-known marketplaces.
Second, make sure your team knows that AI tool impersonation is a growing attack vector. Fake versions of Claude, Copilot, and similar popular tools are being used to trick developers who are simply trying to work faster. Awareness is a real defence here.
Third, consider what external visibility you have into your own exposure. If a developer's credentials have already been harvested and are sitting in a breach database or an infostealer log, you need to know before an attacker acts on them. The same applies to any company domains, email addresses, or code repositories that may have been leaked.
The Bigger Picture for SMB Security in 2026
Attacks through developer tools and software supply chains are not slowing down. They are increasing in sophistication precisely because they exploit trust — trust in marketplaces, trust in familiar brand names, trust in tools that have been used safely before. Malicious VS Code extensions and editor plugins are now a standard part of the attacker playbook, not an edge case.
SMBs are not immune to this. In fact, smaller teams with fewer controls and less dedicated IT oversight are often more exposed. The good news is that early detection changes everything. Knowing that your credentials or infrastructure details have surfaced somewhere they should not be gives you the chance to act before an attacker does.
If you are not sure what your current exposure looks like, run a free audit at breachrr.com/audit. We scan breach databases, infostealer dumps, dark web markets, and public repositories so you get a clear picture of what is already out there — and what needs your attention first.
Want to see if your company is exposed?