Cursor'dagi zararli Claude Code kengaytmasi SSH orqa eshiklarini o'rnatdi

Anthropic'ning Claude Code VS Code kengaytmasining zararli versiyasi 29-oktabr kuni Cursor kengaytma bozorida taxminan 11 soat davomida tarqatildi va 5000 tagacha dasturchini SSH orqa eshiklarini o'rnatish uchun mo'ljallangan zararli dasturga duchor qildi.

Kengaytma 2.1.313 versiya raqamini ishlatgan va Tinch okean vaqti bilan soat 2:27 dan 13:35 gacha tarqatilgan.

Cursor — Microsoft'ning ochiq kodli Visual Studio Code (VS Code) asosida qurilgan, VS Code kengaytmalarini qo'llab-quvvatlaydigan sun'iy intellektga asoslangan kod muharriri. Anthropic'ning Claude Code kengaytmasi o'zining sun'iy intellekt kodlash yordamchisini mos muharrirlarga to'g'ridan-to'g'ri olib kiradi va dasturchilarga tabiiy til ko'rsatmalari yordamida kod yozish va tuzatishda yordam beradi.

Cursor Anthropic zararli kengaytmani ishlab chiqmaganini aytgan, ammo hujumchilar Anthropic nomi ostida buzilgan paketni qanday tarqatganini tushuntirmagan.

"Bugun taxminan soat 2:27 dan 13:35 gacha PT, Anthropic'ning Claude Code kengaytmasining zararli tarzda o'zgartirilgan versiyasi Cursor VS Code kengaytma bozorida mavjud bo'ldi", deb ogohlantirdi Cursor.

"Kengaytma doimiy SSH orqa eshigini o'rnatishga urinadigan zararli kodni ishga tushiradi."

Phorion va OpenSourceMalware tadqiqotchilari hujumchilar kengaytmaning extension.js faylining boshiga zararli JavaScript yuklovchini kiritganini, kengaytmaning qonuniy kodini esa o'zgartirmaganini aniqladilar.

Zararli kod kengaytma yuklanganda, Claude Code bilan foydalanuvchi o'zaro aloqasini talab qilmasdan ishga tushadi.

O'rnatilganda, zararli kengaytma buzilgan tizimlarda quyidagi harakatlarni bajaradi:

• Tizim va foydalanuvchi ma'lumotlarini, jumladan Git elektron pochtasi va ommaviy IP manzilini to'playdi.
• Hujumchi nazoratidagi SSH kalitini qo'shadi va SSH kirishini yoqishga hamda teskari tunnelni o'rnatishga urinadi.
• macOS LaunchAgent yoki Windows rejalashtirilgan vazifa/Ishga tushirish skripti orqali doimiylikni o'rnatadi va tunnelni taxminan har daqiqada qayta urinadi.
• Xost tafsilotlari va orqa eshik holatini hujumchining 134.209.82[.]225 IP manzilidagi serveriga yuboradi.

.jpg)

Hujum zanjiri Manba: OpenSourceMalware

Biroq, Phorion ma'lumotiga ko'ra, zararli dastur SSH o'rnatish tartiblaridagi kodlash xatolari hujumchilarga ko'plab ta'sirlangan Windows va macOS tizimlariga masofadan kirish imkonini berishdan to'sqinlik qilgan bo'lishi mumkin.

Xatolar zararli dasturga SSH allaqachon ishlamayotgan mashinalarda yoqilishini oldini oldi va teskari tunnel buzilgan qurilmaga kirish imkonini bera olmadi.

macOS'da zararli dastur systemsetup -getremotelogin buyrug'i yordamida Masofadan kirish yoqilganligini tekshirishga urinadi, ammo uni yuqori huquqlarsiz ishga tushiradi. SSH xizmatining holatini qaytarish o'rniga, buyruq administrator kirish xatosini hosil qiladi.

Zararli dastur faqat natija "Off" (O'chirilgan) ni o'z ichiga olganda SSH ni yoqishga urinadi, shuning uchun faollashtirish bosqichini butunlay o'tkazib yuboradi.

Windows'da zararli dastur PowerShell orqali OpenSSH serverini o'rnatish va ishga tushirishga urinadi, ammo buni /bin/sh, ya'ni standart Windows o'rnatishlarida mavjud bo'lmagan Unix qobig'i orqali qilishga urinadi. Shu sababli SSH o'rnatilishi muvaffaqiyatsiz tugaydi.

Har ikkala holatda ham zararli dastur o'z SSH kalitlarini o'rnatishi, doimiylikni o'rnatishi va teskari tunnelni yaratishga urinishi mumkin. Biroq, agar SSH serveri allaqachon ishlamayotgan bo'lsa, tunnel buzilgan mashinaga kirish imkonini bera olmaydi.

SSH orqa eshigi muvaffaqiyatsiz bo'lsa ham, zararli dastur hali ham hujumchining serveriga razvedka ma'lumotlarini yuboradi, jumladan jabrlanuvchining foydalanuvchi nomi, xost nomi, ommaviy IP manzili, Git elektron pochta manzili va nozik ma'lumotlar bilan bog'liq muhit o'zgaruvchilari nomlari.

Biroq, skript to'g'ridan-to'g'ri ma'lumotlarni o'g'irlamaydi, bu hujumchilar SSH tunnel orqali kirish imkoniga ega bo'lgandan so'ng nozik ma'lumotlarni qo'lda olishni rejalashtirganini ko'rsatadi.

Cursor zararli kengaytmani olib tashladi va boshqa kengaytmalarni tekshirish va barcha kirish kalitlarini aylantirish uchun butun bozorini vaqtincha yopdi, so'ngra uni qayta ochdi.

Kompaniya shuningdek, xosting provayderi bilan hamkorlik qilib hujumchining serverini o'chirib qo'ydi va bu teskari SSH ulanishlari hamda razvedka ma'lumotlari uzatilishini to'xtatdi.

Ichki tekshiruvdan so'ng, Cursor boshqa kengaytma versiyalari yoki rasmiy tarqatish ta'sirlanmaganini tasdiqlovchi dalil topmaganini aytdi.

Ta'sirlanish oynasi davomida paketni yuklab olganlar o'z mashinalarida 'svc-telemetry' SSH kalitining mavjudligini tekshirishlari va ta'sir tasdiqlansa Cursor'ning tuzatish ko'rsatmalariga amal qilishlari kerak.

Ta'sirlangan mashinalar uchun ularni ajratib qo'yish, kirish mumkin bo'lgan maxfiy ma'lumotlarni aylantirish, sessiyalarni bekor qilish va ta'sirlangan muhitni xavfsiz zaxira nusxalaridan qayta qurish tavsiya etiladi.

Dastlabki xabarlar npm, Open VSX va Microsoft'ning Visual Studio Code Marketplace ham ta'sirlanganini ko'rsatgan bo'lsa-da, keyinchalik faqat Cursor zararli kengaytmani tarqatgan yagona manba ekanligi tasdiqlandi.

Biroq, ta'minot zanjiri hujumi haqida ko'plab savollar javobsiz qolmoqda, jumladan tahdid ishtirokchilari Cursor bozorida Anthropic nomi ostida zararli kengaytmani qanday nashr etgani va hodisa davomida Cursor yoki Anthropic tizimlari buzilganmi yoki yo'qmi.

BleepingComputer Anthropic va Cursor bilan hujum haqida savollar bilan bog'landi va javob olinsa ushbu hikoyani yangilaydi.

Hujumchilar haqiqiy ma'lumotlarga ega bo'lgach, ularning harakatlarining faqat 37% i bloklanadi

Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy ma'lumotlardan foydalanganda, oldini olish keskin pasayadi.

Blue Report 2026 mijozlar ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnikadan texnikaga himoyalarni o'lchaydi.

Hisobotni oling

A malicious version of Anthropic's Claude Code VS Code extension was distributed through Cursor's extension marketplace for approximately 11 hours on October 29, exposing up to 5,000 developers to malware designed to install persistent SSH backdoors.

The extension used the version number 2.1.313 and was distributed between 2:27 a.m. and 1:35 p.m. Pacific Time.

Cursor is an AI-powered code editor built from Microsoft’s open-source Visual Studio Code (VS Code), with support for VS Code extensions. Anthropic’s Claude Code extension brings its AI coding assistant directly into compatible editors, helping developers write and debug code using natural-language instructions.

Cursor says Anthropic did not develop the malicious extension but has not explained how attackers distributed the compromised package under Anthropic's name.

"Between about 2:27 am PT and 1:35 pm PT today, a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code extension Marketplace," warned Cursor.

"The extension runs malicious code that attempts to install a persistent SSH backdoor."

Researchers at Phorion and OpenSourceMalware found that the attackers inserted a malicious JavaScript loader at the beginning of the extension's extension.js file, leaving the legitimate extension code otherwise unchanged.

The malicious code executes when the extension loads, without requiring user interaction with Claude Code.

When installed, the malicious extension performs the following actions on compromised systems:

• Collects system and user information, including Git email and public IP address.
• Adds an attacker-controlled SSH key and attempts to enable SSH access and establish a reverse tunnel.
• Installs persistence through a macOS LaunchAgent or Windows scheduled task/Startup script, retrying the tunnel roughly every minute.
• Sends host details and backdoor status to the attacker’s server at the IP address 134.209.82[.]225

.jpg)

Attack chain Source: OpenSourceMalware

However, according to Phorion, coding errors in the malware's SSH setup routines likely prevented attackers from gaining remote access to many affected Windows and macOS systems.

The mistakes prevented the malware from enabling SSH on machines where it was not already running, leaving the reverse tunnel unable to provide access to the compromised device.

On macOS, the malware attempts to check whether Remote Login is enabled using the systemsetup -getremotelogin command, but runs it without elevated privileges. Instead of returning the SSH service's status, the command produces an administrator-access error.

Because the malware only attempts to enable SSH when the output contains "Off," it skips the activation step entirely.

On Windows, the malware attempts to install and start the OpenSSH server through PowerShell, but it tries to do so via /bin/sh, a Unix shell that isn't available on standard Windows installations. Due to this, the SSH setup fails.

In both cases, the malware can still install its SSH keys, establish persistence, and attempt to create the reverse tunnel. However, if the SSH server is not already running, the tunnel cannot provide access to the compromised machine.

Even if the SSH backdoor fails, the malware still sends reconnaissance data to the attacker's server, including the victim's username, hostname, public IP address, Git email address, and names of environment variables associated with sensitive credentials.

However, the script does not directly steal credentials, suggesting the attackers intended to retrieve sensitive data manually after gaining access through the SSH tunnel.

Cursor removed the malicious extension and temporarily shut down its entire marketplace to audit other extensions and rotate all access keys before making it available again.

The company also worked with the hosting provider to take the attacker's server offline, disrupting both the reverse SSH connections and the transmission of reconnaissance data.

Following an internal investigation, Cursor says it found no evidence that any other extension versions or the official distribution were affected.

Those who have downloaded the package during the exposure window should check for the presence of an 'svc-telemetry' SSH key on their machines, and follow Cursor’s remediation instructions if impact is confirmed.

For impacted machines, it is recommended to isolate them, rotate accessible secrets, invalidate sessions, and rebuild the affected environment from safe backups.

While initial reports suggested that npm, Open VSX, and Microsoft's Visual Studio Code Marketplace were also impacted, it was later confirmed that Cursor was the only source distributing the malicious extension.

However, many questions remain unanswered about the supply chain attack, including how the threat actors published a malicious extension under Anthropic's name on Cursor's marketplace and whether Cursor or Anthropic's systems were compromised during the incident.

BleepingComputer contacted Anthropic and Cursor with questions about the attack and will update this story if we receive a response.

Once attackers have valid credentials, only 37% of their actions are blocked

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report