Оригинальный текст на языке EN взят с сайта-источника. Источник ↗

Malicious Claude Code extensions distributed through Cursor’s VS Code The Extension Marketplace tried to create persistent SSH backdoors on Windows and macOS developer systems.

The affected packages were the Anthropic.claude-code versions 2.1.312 and 2.1.313, which were available on October 29, 2026, between approximately 2:27 a.m. and 1:35 p.m.

Cursor stated that Anthropic did not develop these modified packages. Extension Marketplace attempted to establish persistent SSH backdoors on Windows and macOS developer systems.

The affected packages, Anthropic.claude-code versions 2.1.312 and 2.1.313, were available on October 29, 2026, between approximately 2:27 a.m. and 1:35 p.m. Pacific Time. Cursor said Anthropic did not develop these modified packages.

According to Cursor’s security notice, updated October 30, investigators found no evidence that other extension versions or the official distribution were affected.

The incident illustrates how malicious developer extensions can turn a trusted coding environment into an entry point for unauthorized access. However, important privilege restrictions limited this payload’s effectiveness.

The modified extension.js collected hostnames, usernames, operating systems, processor architectures, home directory paths, working directories, configured Git email addresses, and public IP addresses.

It also gathered environment variable names. Cursor’s description does not establish that the initial collection included environment variable values, a distinction relevant when assessing potential credential exposure.

The payload attempted to append an attacker-controlled SSH public key, identified by the comment svc-telemetry, to SSH authorization files.

It then tried to enable the local SSH service and establish a reverse tunnel to 134[.]209[.]82[.]225 over TCP port 22. HThe attackertransmitted thost reconnaissance hrough HTTP POST requests to the beacon endpoint on port 8099.

The tunneling command included ssh -N -R ‘*:0:localhost:22’, while associated options disabled host-key verification and configured connection keepalives. Background scripts retried the tunnel approximately every 60 seconds.

This use of legitimate remote-access tooling parallels SSH-based backdoor techniques that establish persistence without relying exclusively on custom remote-control malware.

On macOS, persistence used a LaunchAgent at ~/Library/LaunchAgents/com.apple.sysmond.plist, with supporting files under ~/.config/. On Windows, the malware attempted to create a scheduled task named SysMon running as SYSTEM, with a Startup-folder script as a fallback. These standalone artifacts could survive removal of the malicious extension itself.

However, Cursor emphasized that enabling SSH required administrator privileges that the extension generally lacked. Coding errors also restricted successful backdoor establishment outside unusual elevated execution scenarios.

The company nevertheless reported unauthorized key insertion, persistence installation, and host-information transmission, making remediation necessary even where remote login failed. The broader risk complements concerns about extension access to developer credentials, but it does not show that this incident exploited that separate weakness.

Cursor removed the packages, temporarily shut down the marketplace, audited access, rotated keys, rebuilt the service, and restored availability. It also worked with the hosting provider to disable the attacker’s server, disrupting both tunneling and external beacons.

Affected organizations should investigate extension-installation records, endpoint events, and network telemetry, isolate machines showing execution evidence, and remove unauthorized keys, persistence files, and tunnel processes.

Cursor recommends assessing whether systems require rebuilding and rotating accessible credentials and sessions from a trusted machine. Its platform-specific cleanup scripts remove the extension and standalone artifacts; uninstalling alone is insufficient.

IoC

TypeIndicatorContext
Extension identifierAnthropic.claude-codeAffected versions: 2.1.312, 2.1.313
Attacker IP134[.]209[.]82[.]225Infrastructure reported disabled
Reverse SSH destinationtunnel@134[.]209[.]82[.]225:22Outbound SSH tunnel
External beaconhxxp://134[.]209[.]82[.]225:8099/beaconHTTP POST reconnaissance
Loopback beacon127[.]0[.]0[.]1:8099/beaconLocal HTTP POST attempt; correlate with other evidence
Unauthorized key commentsvc-telemetrySearch SSH authorization files
Unauthorized key fingerprintSHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htkAttacker-added SSH key
Reverse-tunnel key fingerprintSHA256:KOAU57+ZG6u3MG4WwzPzPX2O5YEe9qdOC1Bl+6MVyDQTunnel authentication key
Payload SHA-256ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15Modified payload
Windows 2.1.313 VSIX SHA-2566786ec90cbd45949695bd7805c9fbb26cfc91bc5fc897de0183d9bcb9cb21731Malicious Windows package
macOS LaunchAgent~/Library/LaunchAgents/com.apple.sysmond.plistLabel: com.apple.sysmond
macOS supporting files~/.config/.smt, ~/.config/.smtkPersistence and tunnel artifacts
Windows supporting files%USERPROFILE%\.config\smt.cmd, %USERPROFILE%\.config\smtkStandalone artifacts
Windows scheduled taskSysMonAttempts SYSTEM execution
Windows Startup fallback%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmdStartup persistence
Temporary artifacts$TMPDIR/.stk_; %TEMP%\.stk_macOS and Windows temporary files

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.