Trojanized Claude Code 2.1.312/2.1.313 extensions on Cursor marketplace planted SSH backdoor on up to 5,000 developer machines

Linha do tempo

1. gbhackers.com ↗ · pub. 31/10/2026 05:10 · coletado 31/10 07:00

   Trojanized Claude Code extensions on Cursor marketplace install persistent reverse-SSH backdoor on developer workstations

   ler a análise desta fonte ocultar

   Microsoft warned that trojanized anthropic.claude-code extension versions 2.1.312 and 2.1.313, distributed through the Cursor marketplace, tried to install a persistent SSH backdoor on developer workstations. Cursor disclosed the incident on October 29, 2026, with the malicious packages available between roughly 2:27 AM and 1:35 PM PDT. Anthropic said its systems were not compromised and that it did not create the packages. Microsoft confirmed that its Visual Studio Marketplace and the Claude Code npm distribution were unaffected. Cursor reported that errors and administrator-permission requirements blocked SSH access on most macOS and Windows hosts, so attempted execution does not prove a successful intrusion.

   Technical Details

   • The packages kept the legitimate extension functionality and added injected JavaScript that runs when the module loads, before normal initialization. Errors are silently suppressed.
   • Using Node.js APIs, the loader collects the hostname, username, OS, architecture, home and working directories, and the global Git email.
   • It lists up to 40 environment-variable names containing strings such as KEY, TOKEN, SECRET, PASS, AWS and GCP, and reports them through a delayed callback. Values are not collected, so this alone does not demonstrate secret theft.
   • It checks authorized_keys for the svc-telemetry marker and appends an embedded Ed25519 public key if the marker is absent.
   • A separate private key, initially stored in a hidden temp file beginning with .stk_, authenticates an outbound reverse tunnel. The SSH arguments are -N -R '*:0:localhost:22', with host-key verification disabled and retry loops for reconnection.
   • Microsoft identified 134.209.82[.]225 as the configured SSH and HTTP destination.
   • Persistence on macOS uses ~/Library/LaunchAgents/com.apple.sysmond.plist. On Linux it is a user-crontab @reboot entry referencing ~/.config/.smt. Both platforms use ~/.config/.smtk for the tunnel identity. On Windows it is a SysMon scheduled task requesting SYSTEM, with a Startup-folder sysmon.cmd fallback.
   • These artifacts sit outside the extension directory, so uninstalling or updating the extension does not remove them.

   Remediation

   • Identify affected installations, preserve the extension packages and host artifacts, and isolate devices showing loader execution or backdoor installation.
   • Correlate network connections with unauthorized keys, tunnel processes, startup actions and authentication events.
   • Remove the confirmed malicious artifacts separately while preserving legitimate SSH configuration.
   • Rotate credentials or revoke sessions where exposure is indicated.
   • Enforce approved-publisher restrictions and installation cooldowns for extensions in managed developer environments.
2. wired.com ↗ · pub. 30/10/2026 17:38 · coletado 30/10 19:01

   Tampered Claude Code extension with backdoor published to Cursor marketplace for ~11 hours, hitting up to 5,000 users

   ler a análise desta fonte ocultar

   A malicious, tampered copy of the Anthropic Claude Code extension for Windows, macOS and Linux was live in the extension marketplace of Cursor (an AI development platform owned by SpaceX) for roughly 11 hours on Thursday. Cursor says it was downloaded by "at most 5,000 users"; the company briefly shut down the marketplace and says no other extensions were affected. The extension carried a backdoor intended to give attackers access to victim devices, but a design flaw in the malware prevented it from fully establishing itself on the vast majority of targets. Phorion was the first to spot it, after detecting it on a customer's Mac. How the extension reached the marketplace remains unclear: Cursor has not said whether it was breached, while Anthropic staff stated publicly that their systems and employee laptops were not compromised and that they did not build or publish the extension.

   Technical Details

   • Vector: a malicious actor used access to Cursor's marketplace to publish tampered versions of the Claude Code extension, according to Anthropic's Felix Rieseberg.
   • Payload: a backdoor giving attackers remote access to victim devices, a typical foothold for deeper network compromise.
   • Cross-platform: Windows, macOS and Linux builds were published.
   • Exposure window: approximately 11 hours; up to 5,000 downloads.
   • The article does not provide IOCs, version numbers or attribution.

   Remediation

   • Cursor published remediation steps on Thursday for the roughly 5,000 affected users; users who installed the Claude Code extension from the Cursor marketplace during the window should follow them.
   • Anthropic states that versions from its official channels are not affected and that only Cursor users are impacted.
3. theregister.com ↗ · pub. 30/10/2026 13:27 · coletado 30/10 14:00

   Malicious Claude Code extension v2.1.313 pushed to Cursor marketplace with SSH backdoor, hitting up to 5,000 developers

   ler a análise desta fonte ocultar

   A tampered copy of the official Claude Code extension, version 2.1.313, was published to Cursor's VS Code marketplace and was available for about 11 hours on Thursday, infecting up to 5,000 developers. The package carried a persistent SSH backdoor for Windows, macOS and Linux. It was first spotted by EDR vendor Phorion. Anthropic denies any compromise of its own systems or employee laptops and says a malicious actor used access to Cursor's marketplace to publish the tampered build. Neither company has explained how the package reached the marketplace.

   Technical Details

   • The extension was live between 0227 and 1335 PT (0927 and 2035 UTC); only Cursor users are affected, and Anthropic's official channels are not.
   • The implant collected usernames, configured Git emails and public IP addresses and forwarded them to the attacker.
   • It dropped the attacker's SSH key, installed a persistence mechanism and attempted to open a reverse SSH tunnel.
   • The tunnel script needed admin rights on macOS and Windows and usually failed, but the data exfiltration, SSH key drop and persistence still occurred.
   • Installing the latest extension version does not remove the persistence mechanism.

   Remediation

   • Cursor removed the malicious version, shut down the VSCode Marketplace, and checked that no other extensions were compromised.
   • Cursor rotated its own keys before restoring the marketplace and worked with a cloud hosting provider to block the connection to the attacker's server.
   • Affected developers should threat hunt in case the SSH tunnel was established, and follow Cursor's advisory and cleanup scripts to wipe the infection.
4. bleepingcomputer.com ↗ · pub. 30/10/2026 11:36 · coletado 30/10 12:00

   Trojanized Claude Code extension on Cursor marketplace planted SSH backdoors on up to 5,000 developer machines

   ler a análise desta fonte ocultar

   A maliciously modified version of Anthropic's Claude Code VS Code extension (version 2.1.313) was distributed via the Cursor extension marketplace for roughly 11 hours on October 29, exposing up to 5,000 developers. The package carried a JavaScript loader prepended to extension.js that attempted to install a persistent SSH backdoor and exfiltrate reconnaissance data to 134.209.82[.]225. Researchers at Phorion and OpenSourceMalware found coding errors that likely prevented successful remote access on many Windows and macOS hosts, though persistence and data collection still worked. Cursor pulled the extension, temporarily shut down its entire marketplace to audit extensions and rotate access keys, and worked with the hosting provider to take the attacker server offline. It remains unexplained how attackers published a package under Anthropic's name; Cursor states Anthropic did not develop it and found no other affected versions.

   Technical Details

   • Malicious loader inserted at the start of extension.js, executing on extension load without user interaction; legitimate code otherwise unchanged.
   • Collects username, hostname, Git email, public IP and names of environment variables tied to sensitive credentials; no direct credential theft, suggesting manual post-access collection.
   • Adds an attacker-controlled SSH key named svc-telemetry, attempts to enable SSH and build a reverse tunnel retried about every minute.
   • Persistence via macOS LaunchAgent or Windows scheduled task/Startup script.
   • Failure modes: on macOS systemsetup -getremotelogin runs without elevated privileges and errors out, so SSH is never enabled; on Windows the PowerShell OpenSSH install is invoked via /bin/sh, which does not exist.
   • Initial reports of npm, Open VSX and the Microsoft VS Code Marketplace being affected were later disproven — Cursor was the only distribution source.

   Remediation

   • Anyone who installed the extension between 2:27 a.m. and 1:35 p.m. PT on October 29 should check for an svc-telemetry SSH key.
   • Isolate impacted machines, rotate all accessible secrets, invalidate sessions and rebuild environments from safe backups, following Cursor's remediation guidance.
5. thehackernews.com ↗ · pub. 30/10/2026 05:55 · coletado 30/10 08:00

   Malicious Claude Code extension on Cursor Marketplace plants SSH backdoor on up to 5,000 developer hosts

   ler a análise desta fonte ocultar

   Researchers disclosed that a trojanized version of the official Anthropic Claude Code VS Code extension was distributed through the Cursor Marketplace, installing a persistent SSH backdoor. The package masqueraded as anthropic.claude-code version 2.1.313 and contained a 66-line malicious loader prepended to the legitimate bundle. Cursor briefly took the marketplace offline, stating at most 5,000 users were impacted, all installs occurring between roughly 2:27 a.m. and 1:35 p.m. PT on October 29, 2026. The malicious build has been removed and Anthropic published 2.1.314 to Open VSX and the Microsoft VS Code Marketplace. The incident follows the OVHcloud CLI binary replacement tied to the GlassWorm operation, underscoring continued supply chain targeting of developer tooling.

   Technical Details

   The loader activates after VS Code startup and when the extension webview opens. It appends an attacker-controlled key labeled svc-telemetry to ~/.ssh/authorized_keys, attempts to enable the local SSH service on Windows, Linux and macOS, and establishes a reverse tunnel to 134.209.82[.]225. Persistence is platform-specific: a scheduled task, crontab entry, or LaunchAgent. Host reconnaissance is beaconed over plaintext HTTP to 134.209.82[.]225:8099/beacon, including public IP from api.ipify[.]org, hostname, local username, OS and CPU architecture, home and working directories, the global Git email, and the names (not values) of up to 40 environment variables matching KEY, TOKEN, SECRET, PASS, AWS or GCP. Enabling SSH requires admin rights the extension usually lacks on macOS and Windows, so inbound logins likely failed on most hosts, but key installation, persistence and beaconing still succeeded. No follow-on payloads were observed.

   Remediation

   Anyone who installed the extension during the window should isolate affected hosts, remove the unauthorized svc-telemetry SSH key and the scheduled task/crontab/LaunchAgent persistence, rotate all credentials and sessions, and update to 2.1.314. Auto-update configurations were a key exposure path.

6. gbhackers.com ↗ · pub. 30/10/2026 05:07 · coletado 30/10 06:00 primeiro registro

   Trojanized Claude Code VS Code extension on Open VSX plants Ed25519 SSH backdoor and reverse tunnel

   ler a análise desta fonte ocultar

   Researchers analyzed an artifact of the Claude Code VS Code extension (anthropic.claude-code v2.1.313) obtained from Open VSX and found 66 lines of injected JavaScript acting as a malicious loader. The code executes when VS Code loads extension.js, before normal initialization, so no Claude conversation is required to trigger it. It performs host reconnaissance, appends an attacker-controlled Ed25519 public key to ~/.ssh/authorized_keys with the comment svc-telemetry, enables SSH services, and opens a persistent reverse SSH tunnel to attacker infrastructure. There is no evidence of compromise in Anthropic's official Microsoft Marketplace distribution, and how the malicious build entered the publishing chain remains unclear.

   Technical Details

   • Loader imports Node.js modules for process execution, filesystem, OS inspection, HTTP and crypto; suppresses exceptions so legitimate functionality continues.
   • Recon collects hostname, username, OS, architecture, home and working directories, and global Git email, plus names (not values) of up to 40 environment variables matching KEY, TOKEN, SECRET, PASS, AWS, GCP.
   • Persistence of access via authorized_keys injection with restrictive permissions and duplicate-marker checks; attempts to enable macOS Remote Login, Linux service commands, or Windows OpenSSH Server.
   • Embedded private key used for outbound connection to [email protected][.]225 with -N -R '*:0:localhost:22' reverse forwarding, host-key verification disabled, reconnecting every 60 seconds.
   • Persistence mechanisms: deceptive macOS LaunchAgent, Linux @reboot crontab, or Windows scheduled task masquerading as SysMon with Startup-folder fallback.
   • After 1.5 seconds it retrieves the public IP and beacons recon JSON over unencrypted HTTP; no secondary payload is downloaded as scripts and keys are embedded.

   Remediation

   • Isolate affected hosts, preserve evidence, and block the C2 address on ports 22 and 8099.
   • Inspect authorized_keys, persistence locations, and ssh/autossh processes with reverse-forwarding arguments.
   • Remove malicious components, rotate all accessible credentials from a clean system, and review authentication, shell, editor, process and network logs.
   • Deleting the extension alone is insufficient; rebuilding affected systems is recommended given interactive SSH access.