Malicious Claude Code Extension Persistence Installation

Lacey Cochrane@NullVectorX

•updated today•2•0•10

Detects persistence mechanisms installed by the trojanized Claude Code extension on Cursor or Node-based applications. On macOS, it detects the creation of LaunchAgent property list files. On Windows, it detects scheduled tasks created via schtasks.exe or event logs, and modifications to the Startup folder.