stepsecurity.io

Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines

On October 29, 2026, trojanized builds (2.1.312 and 2.1.313) of the official Claude Code VS Code extension were published to Cursor's VS Code Extension Marketplace for macOS and Windows.
stepsecurity.io

Binance’s $6.34 Billion Hack: Developer Machines, AI Tooling, and Wallet Signing

Binance’s November 3 findings trace the attack from a malicious interview assignment through developer tools, an internal AI tool, and stolen deployment credentials to wallet signing. We examine the ...
stepsecurity.io

OVHcloud CLI Compromised via GitHub Release Swap: Detonating the Real GlassWorm Loader and What We Found

An attacker swapped the binaries on five OVHcloud CLI releases, stayed live for 94 minutes, and deleted the evidence. We rebuilt the exact attacker build, recovered the GlassWorm loader from an ...
stepsecurity.io

eMudhra / emSign CA Compromise: What Python, pip, and CI/CD Users Need to Update

Compromised eMudhra intermediate CA keys put Python dependency downloads at risk. Here are the affected tools, verified certificate-trust results, and remediation steps for pip, uv, virtual ...
stepsecurity.io

OpenCode Security Breach: Distillation Attack Hit Console Users With Linked AI Providers. How to Find OpenCode on Developer Machines and Respond

OpenCode reported a breach affecting Console users with linked AI providers. Here is what the vendor has said, and how to find OpenCode on your developer machines.