Game devs are being extorted with AI game-cloning threats

Risky Business reports that a threat actor placed SSH backdoors on 5,000 systems by publishing a malicious version of Anthropic's Claude Code extension for VS Code. The extension was served from the Cursor IDE extension marketplace, according to the bulletin. The report states that Cursor subsequently removed the extension and worked with a cloud provider to take down the attacker's command-and-control server.

The same bulletin describes a second campaign in which a threat actor posed as AI agents to scan enterprise networks. According to the report, the actor rotated through 32 different bots, including ChatGPT, Claude and Perplexity, and searched for unsecured passwords, API keys and cloud credentials. The activity is described as dating from late September.

The bulletin is headlined around game developers being extorted with AI game-cloning threats, and presents that activity alongside the marketplace compromise and the credential-scanning campaign. The bulletin does not identify the threat actors behind either campaign, and provides no figure for the number of game developers contacted or for any sums demanded.