VULNpocalypse
HighSupply chainPatch available

Trojanized Claude Code extension on the Cursor marketplace planted a persistent SSH backdoor

A tampered Anthropic.claude-code extension (2.1.312/2.1.313) was live on Cursor’s marketplace ~11 hours, planting an SSH backdoor. Rotate keys, remove it.

Published
Updated
Fixed in
Anthropic.claude-code 2.1.314 (clean), on Open VSX and the VS Code Marketplace
Exploitation
Yes. The malicious versions were live on Cursor’s marketplace for about 11 hours on 29 October 2026 and reached at most 5,000 users, per Cursor

What happened

  • 29 October 2026: A tampered copy of the Claude Code extension, published under Anthropic’s legitimate publisher identity as Anthropic.claude-code, went live on the Cursor VS Code Extension Marketplace (Microsoft). Cursor says the malicious versions “were not developed by Anthropic” (Cursor).
  • The affected versions are 2.1.312 and 2.1.313, for Windows and macOS (Cursor).
  • The malicious code was a 66-line loader inserted before the legitimate code in the extension’s main JavaScript bundle; an injected routine runs when the extension module loads, before the normal activation path, so no user interaction is needed (The Hacker News; Help Net Security).
  • The package was available between about 2:27 a.m. and 1:35 p.m. Pacific Time on 29 October 2026, roughly 11 hours (Cursor; Cyber Security News). Anthropic said it remained live for close to 12 hours (The Hacker News).
  • Cursor said at most 5,000 users were affected and that it would contact impacted users directly (The Hacker News; The Register).
  • 30 October 2026: Microsoft, which analyzed the extension, confirmed the version was never published to the Visual Studio Marketplace or npm (@anthropic-ai/claude-code) (Microsoft; The Hacker News).
  • 30 October 2026: Cursor updated its security notice to clarify the affected versions and expand detection details, and confirmed the attacker’s server had been taken offline so the reverse shell and beacon no longer function (Cursor; Cyber Security News).

Who found it, and the disputed framing

Reporting credits more than one firm. The Hacker News attributes the disclosure to OpenSourceMalware, naming co-founder Jenn Gile and security researcher Paul McCarty, with separate analysis by Cursor, Microsoft, and Socket (The Hacker News). The Register and Help Net Security credit macOS security firm Phorion, led by CEO Calum Hall (The Register; Help Net Security).

Several outlets led with the claim that Anthropic itself had been hacked. Anthropic disputes that. Felix Rieseberg, a member of its technical staff, said it “wasn’t a compromise of Anthropic’s systems or employee laptops,” that “A malicious actor used access to Cursor’s marketplace to publish a tampered copy,” and that “The versions on our official channels are not affected” (The Register). Neither company has explained how the attacker published under Anthropic’s name on Cursor’s marketplace (The Register; The Hacker News).

There is also a dispute over Open VSX. Help Net Security reported Phorion flagged the package on Open VSX, but Ax Sharma of Manifold Security disputed that the Open VSX copy was compromised, saying it was the official extension in Cursor’s marketplace (Help Net Security). The Hacker News and Socket found no evidence of Open VSX distribution (The Hacker News).

What the backdoor does

  • Reconnaissance. The loader collects the public IP, hostname, username, OS and architecture, home and working directories, and the global Git email, plus the names, not the values, of up to 40 environment variables matching terms like KEY, TOKEN, SECRET, PASS, AWS, or GCP (Microsoft; Cursor). It sends this to 134.209.82.225:8099/beacon over unencrypted HTTP (The Hacker News).
  • SSH key injection. It appends an embedded Ed25519 public key labeled svc-telemetry to the user’s authorized_keys file (Microsoft).
  • Reverse SSH tunnel. A separate embedded private key authenticates an outbound SSH connection requesting a server-allocated remote port forward to the workstation’s local port 22 (ssh -N -R '*:0:localhost:22'), with host-key checking disabled. It prefers autossh on Unix-like systems and a hidden PowerShell loop on Windows, retrying about 60 seconds after SSH exits (Microsoft).
  • Persistence. macOS: a LaunchAgent named com.apple.sysmond.plist plus ~/.config/.smt and ~/.config/.smtk. Linux: a user-crontab @reboot entry referencing ~/.config/.smt. Windows: a scheduled task named SysMon requesting SYSTEM execution, with a sysmon.cmd fallback in the Startup folder (Microsoft).
  • Impact caveat. Enabling SSH and the reverse tunnel needs administrator rights, which the extension usually lacks on macOS and Windows, so remote login often failed (Cursor; The Register). Even when it failed, the attacker’s key, persistence artifacts, and data collection may still have been written (Cyber Security News; Help Net Security).

Indicators of compromise

Network (Cursor; Microsoft):

  • Attacker IP: 134.209.82[.]225
  • HTTP POST beacon to that IP on port 8099 at /beacon, plus a loopback beacon to 127.0.0.1:8099
  • Reverse SSH to TCP 22 on that IP

SSH (Microsoft; Cursor):

  • Unauthorized key comment: svc-telemetry
  • Unauthorized key fingerprint: SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk
  • Reverse-tunnel key fingerprint: SHA256:KOAU57+ZG6u3MG4WwzPzPX2O5YEe9qdOC1Bl+6MVyDQ
  • Temporary tunnel identity filename pattern: .stk_[0-9a-f]{10}

Files and persistence (Microsoft; Cursor):

  • Linux/macOS: ~/.config/.smt, ~/.config/.smtk, com.apple.sysmond.plist (macOS LaunchAgent), cron @reboot entry (Linux)
  • Windows: %USERPROFILE%\.config\smt.cmd, %USERPROFILE%\.config\smtk, scheduled task SysMon, sysmon.cmd in the Startup folder

Hashes (Microsoft; Cursor):

  • extension.js payload SHA-256: ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15
  • Decoded tunnel private key SHA-256: 7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278
  • Modified VSIX 2.1.313 (darwin-arm64) SHA-256: 80402fdcad8799285fd93044976973ca000da7995fb93363f819bb8e4f84ee6c
  • Modified VSIX 2.1.313 (win32-x64) SHA-256: 6786ec90cbd45949695bd7805c9fbb26cfc91bc5fc897de0183d9bcb9cb21731

Microsoft Defender detections include Trojan:JS/CredTheft.MS!MTB, Trojan:MacOS/SmtShellMal.A, and HackTool:MacOS/RevAnthShell.A (Microsoft).

What to do

  • Do not rely on removing the extension alone. Microsoft and Cursor both warn that removing or updating the extension does not remove artifacts written outside its installation directory (Microsoft; Cursor).
  • Collect evidence first, then isolate any host where the payload executed or the backdoor was installed (Microsoft; Cyber Security News).
  • Check authorized_keys on macOS/Linux (~/.ssh/authorized_keys) and Windows (%USERPROFILE%\.ssh\authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys) for the svc-telemetry entry; confirm the fingerprint before removing only that key (Microsoft).
  • Remove the persistence artifacts and tunnel processes listed above, and delete .stk_ temporary files (Microsoft). Cursor publishes cleanup scripts, remediate-macos.sh (run as the affected user, not root) and remediate-windows.ps1 (run as Administrator) (Cursor).
  • Rotate credentials and revoke sessions reachable from affected hosts, from a trusted system, and assess whether the device should be rebuilt (Cursor; Help Net Security).
  • Update to 2.1.314 or later from official channels (Open VSX and the VS Code Marketplace), and turn off auto-updates for Claude Code if enabled (The Hacker News).
  • For prevention, restrict extensions to approved publishers and set an installation cooldown for new versions (Microsoft).

Sources

</content> </invoke>