TL:DR

A malicious version of Anthropic’s Claude Code 2.1.313 was recently uploaded on Cursor Extension Marketplace that allowed attackers to create persistent SSH backdoors. Cursor took the affected version down immediately, blocked further distribution, and urged users to upgrade to 2.1.314.

Overview

On 29th October, Cursor identified a security incident involving Anthropic’s Claude Code version 2.1.313 in its Cursor VS Code extension Marketplace that was not developed by Anthropic. The malicious version allowed attackers to create a persistent SSH backdoor.

With this blog, we will understand what the threat is about, its impact on affected organizations, and what they can do to defend.

About the threat

The malicious version contains an injected JavaScript loader that executes when the extension is loaded by VS Code. It modifies SSH configurations, attempts to enable SSH access, and establishes a reverse SSH tunnel to attacker-controlled infrastructure. The malware additionally collects host information and creates a persistent mechanism across Windows, Linux, and macOS.

How does it impact organizations?

Once successful, an attacker can :

• Establish persistent remote access through an attacker-controlled SSH public key.
• Enable SSH or Remote Login services to make affected systems accessible.
• Establish a reverse SSH tunnel to 134.209.82.225 over SSH.
• Collect host information, including usernames, hostnames, operating system details, Git email addresses, and names of potentially sensitive environment variables.
• Maintain persistence through cron jobs, macOS LaunchAgents, Windows scheduled tasks, or Startup folder entries.

Official security guidance

• Identify systems where the Cursor Marketplace Claude Code extension version 2.1.313 was installed or loaded.
• Disconnect suspected compromised systems from the network and preserve relevant forensic evidence.
• Block communication with the identified malicious IP address 134.209.82.225 over ports 22 and 8099.
• Remove the malicious extension and associated persistence mechanisms after collecting evidence.
• Rebuild confirmed compromised systems using trusted installation media and verified software sources.
• Rotate potentially exposed credentials, SSH keys, API tokens, Git credentials, and other secrets from a known-clean system.

SharkStriker’s recommendations

• Restrict local user accounts from enabling SSH services or modifying SSH configurations. 
• Allow SSH access and service configuration changes only to authorized administrators.
• Download and install extensions exclusively from official, trusted marketplaces, and verify the publisher and extension version before installation.
• Identify endpoints and developer workstations where [email protected] from the Cursor Marketplace was installed.
• Update the Claude Code extension to version 2.1.314 or later.
• Search endpoint telemetry for connections to 134.209.82.225 over ports 22 and 8099.
• Examine SSH authorized_keys files for the suspicious key comment svc-telemetry and the associated SSH key fingerprint.
• Identify suspicious persistence artifacts, including ~/.config/.smt, ~/.config/.smtk, com.apple.sysmond.plist, SysMon, and sysmon.cmd.
• Identify unexpected SSH or autossh processes using reverse port forwarding with -R *:0:localhost:22.
• Isolate suspected compromised systems and preserve relevant logs, files, and forensic evidence.
• Rebuild confirmed compromised systems from trusted sources and rotate potentially exposed credentials from clean systems.
• Assess connected development environments, source-code repositories, and CI/CD systems for unauthorized access using credentials stored on affected endpoints.

SharkStriker’s actions

• Notified the client about the identified threat and its potential impact.
• Assessed the published technical analysis describing the trojanized Claude Code extension.
• Identified the affected extension version, execution mechanism, SSH persistence techniques, and network indicators.
• Performed threat hunting to identify potential indicators of compromise and suspicious activity across the monitored environment.
• Recommended endpoint identification, network blocking, evidence preservation, credential rotation, and system recovery for affected environments.
• The existing SOC detection rules are capable of detecting activity associated with this threat, including suspicious SSH activity and backdoor-related behavior.