Zararli Claude Code VS Code kengaytmasi ishlab chiquvchilarga masofadan kirish berish uchun doimiy SSH orqa eshikni o'rnatadi

Trojanlashtirilgan Claude Code kengaytmasi, anthropic.claude-code 2.1.313 versiyasi sifatida aniqlangan, ishlab chiquvchi tizimlariga doimiy SSH kirish imkonini beradigan zararli yuklovchini o'z ichiga oladi.

Tadqiqotchilar Open VSX dan olingan artefaktni tahlil qilishdi va qonuniy kengaytma to'plamiga qo'shilgan 66 qator JavaScript kodini aniqlashdi. Bu qo'shimcha kod hujumchining skriptini normal ishga tushirish jarayonidan oldin ishga tushirishga imkon beradi.

Topilmalar tahlil qilingan artefaktda zararli xatti-harakatni tasdiqlaydi. Biroq, Anthropicning Microsoft Marketplace'dagi rasmiy tarqatishda buzilish dalili yo'q. Bu zararli versiya nashr zanjiriga qanday kirib qolgani noma'lum qolmoqda.

Texnik tahlilga ko'ra, in'ektsiya qilingan yuklovchi VS Code extension.js ni yuklaganda ishga tushadi. Ishlab chiquvchilar Claude suhbatini boshlashi shart emas. Paket o'rnatish hujumlaridan farqli o'laroq, bajarilish kengaytma ishga tushish vaqtida sodir bo'ladi, npm hayot sikli skriptlari orqali emas.

Yuklovchi jarayonni bajarish, fayl tizimiga kirish, operatsion tizimni tekshirish, HTTP aloqasi va kriptografik operatsiyalar uchun Node.js modullarini import qiladi. U aksariyat istisnolarni bostiradi, bu esa zararli operatsiyalar muvaffaqiyatsiz bo'lganda ham qonuniy funksionallikni davom ettirishga imkon beradi.

Uning razvedkasi xost nomi, foydalanuvchi nomi, operatsion tizim, arxitektura, uy katalogi, ishchi katalog va global Git elektron pochtasini yig'adi.

Shuningdek, u KEY, TOKEN, SECRET, PASS, AWS va GCP kabi ma'lumotlarga oid atamalar bilan mos keladigan 40 tagacha muhit o'zgaruvchilari nomlarini to'playdi. Dastlabki beacon ularning qiymatlarini to'g'ridan-to'g'ri o'z ichiga olmaydi.

Bu suiiste'mol ilgari soxta Open VSX kengaytmalari ishlab chiquvchi metama'lumotlarini yig'ib olganida fosh etilgan xavflarni aks ettiradi, bu yerda tanish brending ruxsat etilmagan xatti-harakatni yashirgan.

Implant hujumchining nazoratidagi Ed25519 ochiq kalitini ~/.ssh/authorized_keys ga svc-telemetry izohi bilan qo'shadi. U cheklovchi katalog va fayl ruxsatlarini o'rnatadi va belgini takrorlashdan qochadi.

Keyin, u macOS Remote Login, Linux xizmat buyruqlari yoki Windows OpenSSH Server konfiguratsiyasi orqali SSH ni yoqishga harakat qiladi. Muvaffaqiyat platforma konfiguratsiyasi va mavjud imtiyozlarga bog'liq.

O'rnatilgan shaxsiy kalit tunnel@134.209.82[.]225 ga chiquvchi ulanishlarni qo'llab-quvvatlaydi. Yo'naltirish argumenti -N -R '*:0:localhost:22' jabrlanuvchining SSH xizmatiga ulangan masofadan ajratilgan portni so'raydi. Tsikl xost kalitini tekshirishni o'chiradi va 60 soniyadan keyin qayta ulanadi.

Claude Hujum Zanjiri (Manba: opensourcemalware)

Doimiylik aldamchi macOS LaunchAgent, Linux @reboot crontab yozuvi yoki Windows SysMon rejalashtirilgan vazifasi va Startup jildidagi zaxira nusxadan foydalanadi.

1,5 soniyadan so'ng, yuklovchi umumiy IP manzilini oladi va razvedka JSON ni shifrlanmagan HTTP beaconlari orqali yuboradi. Ilgari Open VSX kengaytmasi GitHub orqali RAT yetkazib berganidan farqli o'laroq, bu in'ektsiya qilingan bosqich qo'shimcha bajariladigan yukni yuklab olmaydi. Uning skriptlari va kalitlari allaqachon o'rnatilgan.

Cheklash ta'sirlangan xostlarni ajratish, dalillarni saqlash va C2 manzilini 22 va 8099 portlarida bloklashni ustuvor qilishi kerak. Tergovchilar ruxsat etilgan kalitlarni, doimiylik joylarini va teskari yo'naltirish argumentlarini o'z ichiga olgan ssh yoki autossh jarayonlarini tekshirishi kerak.

Dalillarni yig'ib olgandan so'ng, zararli komponentlarni o'chiring, toza tizimdan foydalanish mumkin bo'lgan ma'lumotlarni aylantiring va autentifikatsiya, qobiq, muharrir, jarayon va tarmoq jurnallarini ko'rib chiqing. Interaktiv SSH kirishi tahlil qilingan yuklovchidan tashqari keyingi faoliyatni yoqishi mumkinligi sababli, kengaytmani o'chirishning o'zi xost tozaligini isbotlay olmaydi. Ta'sirlangan tizimlarni qayta qurish kuchliroq kafolat beradi.

IoC

Eslatma: IP manzillar va domenlar tasodifiy hal qilish yoki giperhavola qilishni oldini olish uchun ataylab defanged qilingan (masalan, [.]). Faqat MISP, VirusTotal yoki SIEM kabi nazorat qilinadigan tahdid razvedka platformalarida qayta fang qiling.

SOCingizga hodisalarni tezda to'xtatish uchun ogohlantirish kontekstini bering. 16K SOCdan tahdid razvedkasini integratsiya qiling.

A trojanized version of the Claude Code extension, identified as anthropic.claude-code version 2.1.313, contains a malicious loader that enables persistent SSH access to developer systems.

Researchers analyzed an artifact obtained from Open VSX and discovered 66 lines of JavaScript added to the legitimate extension bundle. This additional code lets the attacker’s script run before the normal initialization process.

The findings confirm malicious behavior in the analyzed artifact. However, there is no evidence of a compromise in Anthropic’s official distribution on the Microsoft Marketplace. It remains unclear how this malicious version entered the publishing chain.

According to the technical analysis, the injected loader runs when VS Code loads extension.js. Developers do not need to start a Claude conversation. Unlike package-installation attacks, execution occurs at extension runtime rather than through npm lifecycle scripts.

The loader imports Node.js modules for process execution, filesystem access, operating-system inspection, HTTP communication, and cryptographic operations. It suppresses most exceptions, allowing legitimate functionality to continue even when malicious operations fail.

Its reconnaissance gathers the hostname, username, operating system, architecture, home directory, working directory, and global Git email.

It also collects names of up to 40 environment variables matching credential-related terms, including KEY, TOKEN, SECRET, PASS, AWS, and GCP. The initial beacon does not directly include their values.

The abuse reflects risks previously exposed by fake Open VSX extensions harvesting developer metadata, where familiar branding concealed unauthorized behavior.

The implant appends an attacker-controlled Ed25519 public key to ~/.ssh/authorized_keys, using the comment svc-telemetry. It sets restrictive directory and file permissions and avoids duplicating the marker.

Next, it attempts to enable SSH through macOS Remote Login, Linux service commands, or Windows OpenSSH Server configuration. Success depends on platform configuration and available privileges.

An embedded private key supports outbound connections to tunnel@134.209.82[.]225. The forwarding argument -N -R ‘*:0:localhost:22’ requests a remotely allocated port connected to the victim’s SSH service. The loop disables host-key verification and reconnects after 60 seconds.

Claude Attack Chain (Source: opensourcemalware)

Persistence uses a deceptive macOS LaunchAgent, a Linux @reboot crontab entry, or a Windows SysMon scheduled task with a Startup-folder fallback.

After 1.5 seconds, the loader retrieves the public IP and sends reconnaissance JSON through unencrypted HTTP beacons. Unlike an earlier Open VSX extension delivering a RAT through GitHub, this injected stage downloads no additional executable payload. Its scripts and keys are already embedded.

Containment should prioritize isolating affected hosts, preserving evidence, and blocking the C2 address on ports 22 and 8099. Investigators should inspect authorized keys, persistence locations, and ssh or autossh processes containing reverse-forwarding arguments.

After collecting evidence, remove malicious components, rotate accessible credentials from a clean system, and review authentication, shell, editor, process, and network logs. Because interactive SSH access enables follow-on activity beyond the analyzed loader, deleting the extension alone cannot establish that a host is clean. Rebuilding affected systems provides stronger assurance.

IoC

Note:IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.