Claude User Security Checklist: Trojanized Claude Code Extension on Cursor, 88 Fake Domains, Fake AI Bots and MFA Phishing — 12 Things to Do Now

1. What happened: four late-October 2026 campaigns aimed squarely at Claude users

Over the past three weeks at least four attack campaigns used the Claude or Claude Code name as bait. None of them broke into Anthropic's systems. All of them used trust in the brand as the way in. The table below shows in one place who is at risk and how you can tell whether you were hit.

Campaign	When	Who is at risk	What to look for	Reported by
Trojanized Claude Code extension on the Cursor Marketplace, versions 2.1.312 and 2.1.313, with an SSH (Secure Shell) backdoor	Oct 29, 2026, 02:27–13:35 Pacific Time, about 11 hours	Cursor users on macOS/Windows who installed or auto-updated in that window. Cursor estimates at most 5,000 people	A key named svc-telemetry in ~/.ssh/authorized_keys, an unfamiliar LaunchAgent or scheduled task, connections to 134.209.82[.]225	Cursor, Phorion, OpenSourceMalware
Fake download sites for Claude Code: 88 domains on 10 hosting platforms, more than 30 of them impersonating Claude Code, delivering the ACRStealer malware	Since early 2026, reported May 27; 32 domains were still live at the time of the report	Developers who search Google and click the ad result instead of the official site	Installers that call rundll32 or mshta, or pipe a long base64 string into zsh; any domain that is not claude.ai, claude.com or anthropic.com	Straiker, TechRepublic
Bots impersonating ClaudeBot, ChatGPT and Perplexity: 32 identities requesting about 90 secret-file paths on web servers	Late September to late October 2026; on one day it reached 48% of organizations that see any AI bot traffic	Anyone running a web server, especially staging sites exposed to the internet	A bot that calls itself ClaudeBot but asks for .env, SSH keys or cloud credential files, from an IP outside Anthropic's published ranges	Cequence
Phishing portals posing as "AI advertising" products for six brands including Claude, capturing both passwords and MFA (Multi-Factor Authentication) codes with a live operator behind the screen	First domain seen Sep 16, reported Oct 6, 2026	People who manage ad accounts or organization accounts	A login popup you cannot drag outside the browser window; a second MFA prompt immediately after the first	Island, The Hacker News

2. The trojanized Claude Code extension on Cursor: what you need to know before you check

This incident differs from an ordinary fake website because the malicious build was published under the real extension identifier anthropic.claude-code in Cursor's marketplace. Anyone who installed it or had auto-update on received the bad build without doing anything wrong. The facts confirmed as of Nov 3, 2026:

• Only the Cursor Marketplace was affected. Early reports also named the VS Code Marketplace, Open VSX and npm, but it was later confirmed that Microsoft's marketplace, Open VSX and the Claude Code installers were not touched.
• Anthropic says its own systems were not breached. The official wording: "A malicious actor used access to Cursor's marketplace to publish a tampered extension targeting Cursor's users, we were not involved with building, publishing or hosting this." Anthropic immediately shipped version 2.1.314 through its own channels to avoid confusion.
• The payload ran the moment the extension loaded. No Claude session, no click needed. It collected the hostname, username, operating system, the names of credential-related environment variables, the Git email address and the public IP, and sent them to a server at 134.209.82[.]225. It then tried to add an SSH key named svc-telemetry to authorized_keys, enable the SSH service and open a reverse tunnel back to the attacker, with persistence through a LaunchAgent on macOS or a scheduled task on Windows, retrying every 60 seconds.
• The attacker's code had bugs, which helped. On macOS the step that enables SSH needs administrator rights and failed on many machines. On Windows it invoked PowerShell through /bin/sh, which does not exist on a standard Windows install. But the information-gathering step had already succeeded, and the key and persistence files may still be on disk.
• The open question. Neither Cursor nor Anthropic has explained how the tampered build got into the marketplace under Anthropic's name. Cursor temporarily shut the marketplace to audit every extension, rotated its access keys, and had the hosting provider take the attacker's server offline.

Channel	Identifier that must match	Status as of Nov 3, 2026
VS Code Marketplace (Microsoft)	Publisher Anthropic, ID anthropic.claude-code, latest version 2.1.317	Not affected
Open VSX	anthropic.claude-code	Not affected
Cursor Marketplace	anthropic.claude-code versions 2.1.312 and 2.1.313	Malicious, removed; move to 2.1.314 or later
Claude Code CLI, official installer	curl -fsSL https://claude.ai/install.sh | bash (macOS/Linux) or irm https://claude.ai/install.ps1 | iex (Windows PowerShell)	Not affected
npm	@anthropic-ai/claude-code	Not affected
Homebrew / WinGet	brew install --cask claude-code / winget install Anthropic.ClaudeCode	Not affected
apt / dnf / apk	Repositories at downloads.claude.ai, signed with key fingerprint 31DD DE24 DDFA B679 F42D 7BD2 BAA9 29FF 1A7E CACE	Not affected

3. The 12-point checklist, in order

The list is split into three groups by who does the work. Items 1–4 are for everyone who uses Claude, items 5–8 for developers and IT teams, items 9–12 for Team and Enterprise plan admins. Each item includes the command or the settings path so you can do it right away.

Group A: everyone who uses Claude

Item 1: check whether your machine ever had the malicious extension from Cursor

Do this first, even if you are not sure you ever used Cursor, because the planted key does not go away when you uninstall the extension. The commands must return nothing.

# macOS, in Terminal as your normal user (no sudo)
grep -n 'svc-telemetry' ~/.ssh/authorized_keys        # must print nothing
ls -la ~/Library/LaunchAgents                          # look for unfamiliar .plist files created after Oct 29, 2026
pgrep -fl 'ssh .*-R'                                   # no reverse tunnel should be running
ls ~/.cursor/extensions 2>/dev/null | grep -i claude   # did 2.1.312 or 2.1.313 ever get installed?

# Windows, in PowerShell
Select-String -Path "$env:USERPROFILE\.ssh\authorized_keys" -Pattern "svc-telemetry"
Get-ScheduledTask | Where-Object { $_.TaskPath -notlike "\Microsoft*" } | Select-Object TaskName, TaskPath, State
Get-ChildItem "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup"
Get-ChildItem "$env:USERPROFILE\.cursor\extensions" | Where-Object Name -like "*claude*"

If you find the svc-telemetry key or an unfamiliar persistence file, treat the machine as compromised. Disconnect it from the network, run Cursor's remediation script (remediate-macos.sh as the affected user, or remediate-windows.ps1 in an elevated PowerShell), then change every password and key that machine could reach, from a different machine. The full sequence is in section 4.

Item 2: install and update Claude Code only through official channels

The 88-domain campaign used two ways to steer people to fake sites: paid Google ads placed above the real results, and SEO (Search Engine Optimization) poisoning through redirect loops. It even had German-language pages built specifically for German developers, so Thai-language pages are only a matter of time. These are the official commands, and every one of them is documented at code.claude.com/docs.

# macOS / Linux / WSL
curl -fsSL https://claude.ai/install.sh | bash
# Windows PowerShell
irm https://claude.ai/install.ps1 | iex
# Alternatives
brew install --cask claude-code
winget install Anthropic.ClaudeCode
npm install -g @anthropic-ai/claude-code
# Verify the binary (macOS must show Anthropic PBC / Windows must show Anthropic, PBC)
codesign --verify --verbose ~/.local/share/claude/versions/*
Get-AuthenticodeSignature "$env:USERPROFILE\.local\share\claude\versions\*"

Three simple rules before you paste any command from any website into a terminal. One, read to the end of the line. If it contains rundll32, mshta, or a long base64 string piped into zsh or bash, stop. Two, the domain must end in claude.ai, claude.com or anthropic.com, nothing else. Three, never click a result marked "Sponsored" to find developer tool documentation. Type the URL or use a bookmark.

Item 3: never give a password, a one-time code or an MFA approval to an AI agent or to any "Connect" window

The phishing portal Island found has a human operator watching each session. When the victim enters an MFA code, the operator can reject it and ask for a fresh one on the spot. The login window is a BitB (Browser-in-the-Browser) popup, a fake drawn inside the web page rather than a real Google or Okta window. The easiest test: drag the popup past the edge of the browser window. A fake one stays trapped inside the page.

• Use a password manager. It will not autofill on a look-alike domain.
• Move high-privilege accounts, such as ad account admins and Team plan admins, to passkeys or FIDO2 security keys, which phishing cannot capture.
• If an Okta prompt, a Google prompt or a number-matching screen appears when you did not just log in, assume someone already has your password. Change it now.
• An AI agent that acts on your behalf should get access through a channel you can revoke, never your real password. If a service offers no such channel, do not connect it.

Item 4: reach Claude only through a bookmark or a typed URL

The official domains you use day to day are few: claude.ai for chat and Team plan admin, claude.com for product and pricing information, code.claude.com for Claude Code documentation, anthropic.com for news and policy, and support.claude.com for the help center. Bookmark these five and stop arriving through search results, because both the fake installers and the fake portals depend on search results.

Group B: developers and IT teams

Item 5: move API keys out of anything the web can reach, then rotate every key you doubt

The fake bots Cequence tracked request about 90 paths that people tend to leave under the web root: .env, cloud credential files, private SSH keys and server environment data. If your web server has ever answered 200 for one of those files, assume the keys inside are gone.

# nginx: deny every file and folder that starts with a dot (.env .git .ssh .aws); put this in the server block
location ~ /\. { deny all; return 404; }

# check the log history: did anyone ever request .env and get a 200?
grep -E 'GET /[^ ]*\.env[^ ]* HTTP' /var/log/nginx/access.log | grep ' 200 ' | head

Then open the Anthropic Console, rotate every API key you doubt, set a spending cap per workspace, and use one key per project so that a leaked key does limited damage and can be revoked without breaking other work. There is more on how Claude handles data in Claude Data Governance & Security.

Item 6: verify bots that claim to be ClaudeBot by IP, not by name

A User-Agent string can be faked in one line. Anthropic publishes the IP ranges of its crawlers at claude.com/crawling/bots.json (the current file is dated Oct 20, 2026). A bot that calls itself ClaudeBot but comes from an IP outside that list, or that asks for secret files, is fake. Cequence also found a tell: every fake identity claiming to be Claude carried the same Anthropic crawler contact string, even when posing as a different agent, because the string was copied and pasted.

# fetch Anthropic's official crawler IP ranges to compare against
curl -s https://claude.com/crawling/bots.json

# a "ClaudeBot" asking for secret files is fake, no IP check needed
grep -i 'claudebot' /var/log/nginx/access.log | grep -E '\.env|\.git/|id_rsa|\.aws/|wp-config' | head

This affects our own reporting too. Every month we count how many times ClaudeBot visits grandlinux.com from the User-Agent in the nginx log. A count like that can include fakes. Next month we will match IPs against Anthropic's list before counting, and anyone producing a similar report should do the same. robots.txt does nothing against fake bots, because they never read it.

Item 7: lock down the update channel for AI tools across the organization

The Cursor incident hit people who had auto-update turned on. If your organization has several developers, pick one channel and pin a minimum version. Claude Code has managed settings that an admin can enforce organization-wide.

// Claude Code settings.json (place it in managed settings to enforce on every machine)
{
  "autoUpdatesChannel": "stable",
  "minimumVersion": "2.1.100"
}
// If you distribute through an internal channel and want everyone on one version, set the env var DISABLE_UPDATES=1 instead

• VS Code has an extensions.allowed policy that lists the publishers or extensions users may install. Set it through MDM (Mobile Device Management) to restrict installs to the Microsoft Marketplace only.
• Teams using Cursor should check where each critical extension comes from, and turn off auto-update for any extension that can reach the terminal.
• Claude Code's stable channel runs about a week behind latest and skips releases with major regressions. For most organizations that trade-off is worth it.

Item 8: let Claude review your own code and read advisories for you

Anthropic's help center states that generally available models can do defensive work without any special approval: secure code review, threat modeling, patching known issues, finding vulnerabilities in your own source code, and triaging security alerts. What the classifiers may interrupt is malware analysis and exploit validation, which is what item 12 is for.

• In Claude Code, type /security-review inside a repository with pending changes. It checks for SQL injection, XSS, authentication and authorization flaws, insecure data handling and vulnerable dependencies. Anthropic also publishes a GitHub Action of the same name that runs on every pull request and comments on findings with suggested fixes.
• Paste an advisory from CISA or a vendor and have Claude turn it into a checklist for your team. That is how we wrote the PHP2Shell article: every version check and IOC command was re-ordered from the original advisory.
• If you connect Claude to internal systems through an agent or MCP, read about prompt injection first, because a document or web page the agent reads can issue instructions to the agent in your name.

Group C: Team and Enterprise plan admins

Item 9: turn on SSO, enforce MFA through your identity provider, and audit the member list

Claude has no separate MFA switch of its own. The way to enforce it is to enable SSO (Single Sign-On) and let your IdP (Identity Provider), such as Google Workspace, Microsoft Entra or Okta, enforce MFA. An Owner or Primary Owner does this at claude.ai/admin-settings/organization under Authentication. You need DNS access for the company email domain to verify it. Once verified, a "Restrict organization creation" toggle appears, which stops employees from creating new Claude organizations with company email addresses.

• The Team plan adds members by invitation only. Automated provisioning through SCIM is an Enterprise plan feature.
• Review the member list monthly and remove leavers immediately. An unattended seat is a door nobody watches.
• If you have no IdP yet, start by enabling 2FA on the Google or Microsoft account used to log in to Claude. The steps are in our 2FA article.

Item 10: write a one-page policy and send it to everyone, today

The rules that work in practice are few. Never type passwords, one-time codes or card numbers into a chat. Never install an extension or installer from a link someone sent you; use only the channels in item 2. If an unrequested login window appears, screenshot it and send it to IT immediately. If the organization has just started using Claude, this policy belongs in week one of the 30-day rollout plan.

Item 11: if you use Cowork, install EDR inside the VM and review data settings

On Nov 3, 2026 Anthropic opened a beta that lets Team and Enterprise plans install an EDR (Endpoint Detection and Response) sensor inside Cowork's VM (Virtual Machine) on macOS and Windows, because security software on the host cannot see the commands Cowork runs inside its isolated box. Supported vendors at launch are CrowdStrike, SentinelOne, Palo Alto Networks, Tanium, Evoke Security, Neo and Pluto Security. Configuration is through MDM on macOS or registry policy on Windows, and it requires Claude Desktop 4.4212.0 or later.

• Coverage applies only to the local VM, not to Cowork sessions hosted on Anthropic's servers.
• The sensor can see prompts, files and Claude's responses inside the VM, and sends them to the EDR vendor rather than Anthropic. Staff need to be told, and you must test before deployment and again after every Claude or sensor update.
• Anthropic itself says this is not a fix for the previously reported Cowork sandbox vulnerability.
• Alongside it, have the Owner review the data retention settings and the "Rate chats" switch as described in our data governance article.

Item 12: security teams that must analyze malware should apply to the Cyber Verification Program

If your team runs into classifiers interrupting malware sample analysis or exploit validation, have an admin apply for the CVP (Cyber Verification Program) at the Defense Access tier at portal.anthropic.com under Programs. Apply once per organization, then assign seats to the people who need them. Anthropic aims to respond within seven business days. You supply organization details, a description of your security work, and an attestation of the security controls for the tier you request. Individuals on a paid plan can apply only for Defense Access; the Red Team and Specialized tiers are for organizations only.

• The program requires data retention so Anthropic can monitor for cyber misuse. Organizations with a ZDR (Zero Data Retention) exemption for Fable or Mythos models can use CVP without retention.
• Organizations that maintain open-source projects can sign up for the free OSS Scanner, a periodic scan that delivers reports with a proof of concept and patching options, launched with the Cyber Mission on Oct 8, 2026.

#	What to do	Who	Time
1	Look for the svc-telemetry key, persistence files and reverse tunnels	Everyone	5 minutes
2	Install/update Claude Code from official channels and verify the signature	Everyone	10 minutes
3	No passwords or one-time codes to agents; drag-test popups; move key accounts to passkeys	Everyone	30 minutes
4	Bookmark the five official domains; stop arriving via search	Everyone	5 minutes
5	Deny dot-files on the web server, check logs, rotate API keys	Developers/IT	1 hour
6	Match ClaudeBot IPs against bots.json; find bots asking for secret files	Developers/IT	30 minutes
7	Pin the update channel and minimum version through managed settings	IT	1 hour
8	Run /security-review and the GitHub Action on main repositories	Developers	Ongoing
9	Enable SSO, enforce MFA via the IdP, audit members	Team plan Owner	Half a day
10	Publish the one-page policy to everyone	Owner/HR	1 hour
11	Install EDR in the Cowork VM; review data retention	IT/Security	1 day including testing
12	Apply for CVP Defense Access / OSS Scanner	Security lead	7 business days for a decision

4. If you find you were hit: the first 24 hours

This sequence applies to the fake extension, the fake installers and the case where someone typed credentials into a fake portal. The key rule: never remediate from the machine you suspect.

• First hour: disconnect. Unplug the network cable, turn off Wi-Fi. Do not power off yet if your security team wants to preserve evidence, and do not just uninstall the extension, because the persistence scripts now run independently of it.
• From a clean machine, change everything that machine could reach. Every SSH key pair, the Anthropic API keys and those of other services, GitHub/GitLab tokens, AWS/GCP/Azure credentials, the password manager master password, and sign out of every active session on every service.
• Look back at what the attacker already did. Commits or pushes from that machine after Oct 29, logins from unknown IPs in cloud and Git audit logs, new API keys you did not create.
• Run Cursor's remediation script, then decide about a rebuild. The script exits non-zero if anything remains. For a machine that held important keys, a rebuild is cheaper than doubt.
• Notify who must be notified. If the machine had access to customers' personal data and there is a risk to the rights of the data subjects, Section 37(4) of Thailand's PDPA (Personal Data Protection Act) requires notifying the Personal Data Protection Committee within 72 hours of becoming aware of the breach. Government agencies report to ThaiCERT or the NCSA under their own frameworks.
• Keep a timeline. Claude can help assemble it from the logs, but a person must verify every line before it goes to anyone.

5. What Claude can help with, and what a person has to do

This article warns about fakes that borrow the Claude name, but the real Claude is a genuinely useful tool for defensive work. The dividing line is between tasks that are reading and drafting, and tasks that are decisions and hands-on changes to live systems.

Task	Can Claude help?	Notes
Review your own code for vulnerabilities (secure code review)	Yes, right away	/security-review in Claude Code or the GitHub Action
Threat-model a system you are about to connect an agent to	Yes	Have it question you layer by layer, then summarize as a table
Read a CISA or vendor advisory and produce a checklist	Yes	Attach the original, require clause numbers, and have it write "not stated" where there is no data
Read logs for IOCs you have listed	Yes	Send logs with personal data removed, have it write the grep, run it yourself
Draft internal notices, phishing awareness drills, executive incident summaries	Yes	Verify every name, date and number before sending
Analyze malware samples, validate exploits	Partly	Classifiers may interrupt; apply for CVP (item 12)
Decide whether to rebuild a machine	No	A person decides based on the importance of the keys that machine held
Rotate keys, change passwords, revoke sessions	No	Never let an agent hold real passwords; do it yourself from a clean machine
Confirm an installer is genuine	No	Check the signature yourself with codesign or Get-AuthenticodeSignature

Conclusion

The four late-October campaigns tell one story. Attackers have stopped trying to break into Anthropic and started breaking into the habits of Claude users instead: an extension under the real name on a marketplace that is not the official one, an ad result that ranks above the real site, a bot that borrows the ClaudeBot name to ask for secret files, and a login page with a human behind it rejecting your MFA code in real time.

If you have half an hour today, do items 1, 3 and 5 first: look for the svc-telemetry key on your machine, stop giving passwords to any agent or popup, and get .env out of anything the web can reach. Work through the rest of the table in section 3 this week. All of the month's news is collected in the AI News Roundup for October 2026.

The Claude name on a download button does not mean Anthropic sent it, and a version number does not tell you either. Verify the channel and the signature, not the name.

- Grand Linux team, from checking our own machines on Nov 3, 2026

References

All facts were checked on Nov 3, 2026 against the notices from Cursor and Anthropic, the official Claude Code documentation, the reports of the security firms that discovered each campaign, and news outlets that confirmed details directly with the companies. Some details remain undisclosed by both Cursor and Anthropic, such as how the tampered build got into the marketplace under the Anthropic name. We will update this article if new information appears

• Cursor — Security notice: malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) in the Cursor Marketplace (Oct 29–30, 2026)
• BleepingComputer — Malicious Claude Code extension on Cursor planted SSH backdoors (Oct 30, 2026)
• The Register — Anthropic: that Claude Code extension compromise couldn't be us (Oct 30, 2026)
• TNW — Anthropic denies breach as tampered Claude Code extension hits Cursor users (Oct 30, 2026)
• The Hacker News — Official Claude Code extension on Cursor Marketplace trojanized with persistent SSH backdoor (Oct 30, 2026)
• Straiker — Fake Claude Code, real malware: ACRStealer impersonation campaign (88 domains) (May 27, 2026)
• TechRepublic — Fake Claude Code installers deliver credential-stealing malware (2026)
• Cequence — AI agent impersonation: attackers pose as ChatGPT, Claude and Perplexity to hunt for secrets (Oct 28, 2026)
• The Hacker News — Fake ChatGPT, Gemini and Claude ad portals capture credentials and MFA codes (Island research) (Oct 6, 2026)
• TechCrunch — Bank of America asks customers not to share banking passwords with AI assistants (Oct 27, 2026)
• Anthropic — Claude Code setup: official install commands, release channels, binary integrity and code signing (official docs)
• VS Code Marketplace — Claude Code extension (anthropic.claude-code) (checked Nov 3, 2026)
• Anthropic — published IP ranges of Claude crawlers (bots.json) (file dated Oct 20, 2026)
• Anthropic Help Center — Real-time cyber safeguards and the Cyber Verification Program (checked Nov 3, 2026)
• Anthropic Help Center — Automated security reviews in Claude Code (/security-review) (checked Nov 3, 2026)
• Anthropic Help Center — Set up single sign-on (SSO) on Team and Enterprise plans (checked Nov 3, 2026)
• Cybersecurity News — Anthropic enables EDR monitoring in Claude Cowork (beta) (Nov 3, 2026)
• CyberScoop — Anthropic rolls out Cyber Mission: Critical Infrastructure Defense Program and OSS Scanner (Oct 8, 2026)
• this week in security — November 1, 2026 edition (Nov 1, 2026)