EN PT-BR
← Voltar ao feed
high technology software development

Trojanized Claude Code extensions on Cursor Marketplace attempt persistent SSH backdoors on Windows and macOS

1 fonte(s) · 1 atualização(ões) · publicado 02/11/2026 02:45 · coletado há 2 horas

Two modified versions of the Anthropic.claude-code extension (2.1.312 and 2.1.313) were served through the Cursor Extension Marketplace on October 29, 2026, between roughly 2:27 a.m. and 1:35 p.m. Pacific Time. Cursor says Anthropic did not build these packages and found no evidence that other versions or the official distribution were affected. The payload fingerprinted hosts, tried to plant an attacker SSH key, and tried to open a reverse SSH tunnel to an attacker server. Privilege restrictions and coding errors limited success, but key insertion, persistence installation and host-info exfiltration were still observed, so remediation is required.

Detalhes técnicos

  • The modified extension.js collected hostnames, usernames, OS, CPU architecture, home and working directories, Git email, public IP and environment variable names (values are not confirmed as collected).
  • It tried to append an SSH public key with the comment svc-telemetry to SSH authorization files, enable the local SSH service, and open a reverse tunnel to 134[.]209[.]82[.]225 on TCP 22 using ssh -N -R '*:0:localhost:22', with host-key verification disabled and keepalives set. Background scripts retried about every 60 seconds.
  • Reconnaissance data was sent by HTTP POST to a beacon endpoint on port 8099.
  • macOS persistence: LaunchAgent ~/Library/LaunchAgents/com.apple.sysmond.plist with support files under ~/.config/.
  • Windows persistence: scheduled task SysMon running as SYSTEM, with a Startup-folder script as fallback.
  • Enabling SSH required admin rights the extension generally lacked, and coding errors further limited backdoor establishment.
  • Artifacts can survive removal of the extension.

Remediação

  • Cursor removed the packages, temporarily shut down the marketplace, audited access, rotated keys, rebuilt the service, and had the attacker's server disabled with the hosting provider.
  • Review extension-installation records, endpoint events and network telemetry; isolate hosts showing execution.
  • Remove unauthorized SSH keys, persistence files and tunnel processes using Cursor's platform-specific cleanup scripts; uninstalling alone is insufficient.
  • Consider rebuilding affected systems and rotate accessible credentials and sessions from a trusted machine.

Linha do tempo

  1. gbhackers.com ↗ · pub. 02/11/2026 02:45 · coletado 02/11 03:00 primeiro registro

    Trojanized Claude Code extensions on Cursor Marketplace attempt persistent SSH backdoors on Windows and macOS

    ler a análise desta fonte

    Two modified versions of the Anthropic.claude-code extension (2.1.312 and 2.1.313) were served through the Cursor Extension Marketplace on October 29, 2026, between roughly 2:27 a.m. and 1:35 p.m. Pacific Time. Cursor says Anthropic did not build these packages and found no evidence that other versions or the official distribution were affected. The payload fingerprinted hosts, tried to plant an attacker SSH key, and tried to open a reverse SSH tunnel to an attacker server. Privilege restrictions and coding errors limited success, but key insertion, persistence installation and host-info exfiltration were still observed, so remediation is required.

    Technical Details

    • The modified extension.js collected hostnames, usernames, OS, CPU architecture, home and working directories, Git email, public IP and environment variable names (values are not confirmed as collected).
    • It tried to append an SSH public key with the comment svc-telemetry to SSH authorization files, enable the local SSH service, and open a reverse tunnel to 134[.]209[.]82[.]225 on TCP 22 using ssh -N -R '*:0:localhost:22', with host-key verification disabled and keepalives set. Background scripts retried about every 60 seconds.
    • Reconnaissance data was sent by HTTP POST to a beacon endpoint on port 8099.
    • macOS persistence: LaunchAgent ~/Library/LaunchAgents/com.apple.sysmond.plist with support files under ~/.config/.
    • Windows persistence: scheduled task SysMon running as SYSTEM, with a Startup-folder script as fallback.
    • Enabling SSH required admin rights the extension generally lacked, and coding errors further limited backdoor establishment.
    • Artifacts can survive removal of the extension.

    Remediation

    • Cursor removed the packages, temporarily shut down the marketplace, audited access, rotated keys, rebuilt the service, and had the attacker's server disabled with the hosting provider.
    • Review extension-installation records, endpoint events and network telemetry; isolate hosts showing execution.
    • Remove unauthorized SSH keys, persistence files and tunnel processes using Cursor's platform-specific cleanup scripts; uninstalling alone is insufficient.
    • Consider rebuilding affected systems and rotate accessible credentials and sessions from a trusted machine.