Fake Claude Code Update in Cursor Planted an SSH Backdoor
A fake Claude Code 2.1.313 on Cursor's extension marketplace added an attacker SSH key, persistence and a reverse tunnel on up to 5,000 developer machines on Oct. 29. Update to 2.1.314 and check for the 'svc-telemetry' key.
For about 11 hours on Oct. 29, Cursor’s extension marketplace handed out a fake update of Anthropic’s Claude Code extension that tried to plant an SSH backdoor, The Hacker News reports. Version 2.1.313 appeared under the real publisher name, but Cursor says Anthropic didn’t build it. OpenSourceMalware found the malicious code, and Cursor’s notice puts the number of affected users at 5,000 at most.
For defenders
What was hit: only the Cursor Marketplace copy of anthropic.claude-code 2.1.313, available from 2:27 a.m. to 1:35 p.m. PT on Oct. 29. OpenSourceMalware says the npm package and the Open VSX and Microsoft VS Code Marketplace extensions weren’t malicious, and Anthropic has since published 2.1.314 there. Cursor hasn’t said how the fake version got into its marketplace; it rebuilt the marketplace, rotated its keys and says no other extension was touched. That’s T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain) through T1176.002 (Software Extensions: IDE Extensions).
What it did: a 66-line loader at the top of extension.js ran as soon as the extension’s panel opened, with no Claude prompt needed. It added an Ed25519 key labeled svc-telemetry to ~/.ssh/authorized_keys (T1098.004 (Account Manipulation: SSH Authorized Keys)), tried to switch on the machine’s SSH server, and opened a reverse SSH tunnel to the attacker’s server so the operator could log in from outside (T1572 (Protocol Tunneling)). The tunnel was kept alive by a LaunchAgent dressed up as com.apple.sysmond on macOS, an @reboot cron entry on Linux, and a SysMon scheduled task plus a Startup-folder fallback on Windows (T1036.004 (Masquerading: Masquerade Task or Service)). It also sent hostname, username, OS, Git email and the names (not values) of up to 40 secret-looking environment variables over plain HTTP.
Status: turning on SSH needs admin rights, so Cursor says that step probably failed on most Macs and Windows PCs, but the key and the persistence were still written. The attacker’s server is now offline and no follow-on payload was seen. No attribution. Same playbook, different target: the GlassWorm hijack of OVHcloud’s CLI earlier this month also went after developer machines.
134.209.82[.]225 (TCP 22, user “tunnel”; HTTP POST :8099/beacon)
Key comment: svc-telemetry
Key fingerprint: SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk~/Library/LaunchAgents/com.apple.sysmond.plist
~/.config/.smt, ~/.config/.smtk, $TMPDIR/.stk_*
%USERPROFILE%\.config\smt.cmd, %USERPROFILE%\.config\smtk
Scheduled task “SysMon”; Startup\sysmon.cmd
ssh -N -R ‘*:0:localhost:22’ (or autossh -M 0)What it means for you
Claude Code is an add-on that lets programmers use Anthropic’s AI inside their code editor. If you don’t use the Cursor editor, this one didn’t reach you. If you do and the extension updated itself on Oct. 29, the bad version may have quietly added a key that lets a stranger log in to your computer. Most Macs and Windows PCs blocked the final step, but the leftovers still need cleaning up.
Do this now
- In Cursor, check the Claude Code extension’s version and update to 2.1.314 or later.
- Search
~/.ssh/authorized_keys(and on WindowsC:\ProgramData\ssh\administrators_authorized_keys) forsvc-telemetry; if it’s there, the machine is affected. - If affected, disconnect it, then remove the key, task, LaunchAgent or cron entry with Cursor’s remediation scripts, or rebuild the machine.
- From a clean computer, rotate the passwords, tokens and cloud keys that machine could reach.
Source article: Official Claude Code VS Code Extension Compromised to Install Persistent SSH Backdoor
Publisher: The Hacker News, author Ravie Lakshmanan
Published: October 30, 2026
URL: https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html
Executive Summary
An unidentified actor got a trojanized build of Anthropic’s Claude Code extension, anthropic.claude-code version 2.1.313, published to the Cursor VS Code extension Marketplace under the legitimate publisher identity, where it was available from 2:27 a.m. to 1:35 p.m. PT on October 29, 2026. Cursor says the version was not developed by Anthropic and that at most 5,000 users installed it; OpenSourceMalware, which disclosed the code, says the npm package and the Open VSX and Microsoft VS Code Marketplace listings were not malicious. No vendor has named or aliased the actor, and how the marketplace was breached is not disclosed. The intrusion chain is: the editor auto-updates or installs 2.1.313; a 66-line loader prepended to extension.js runs when the extension’s webview opens; it fingerprints the host (hostname, user, OS, architecture, Git email, names of up to 40 secret-like environment variables, public IP) and POSTs that over HTTP to port 8099; it appends an Ed25519 key labeled svc-telemetry to authorized_keys; it tries to enable the local SSH server; and it opens a reverse SSH tunnel as user tunnel to 134.209.82[.]225 that forwards a server-allocated port back to the victim’s port 22, kept alive by a masqueraded LaunchAgent, cron entry or scheduled task. The objective is interactive SSH access to developer workstations, which hold source code, cloud credentials and CI secrets; the impact is limited where enabling SSH failed for lack of admin rights, but the key and persistence were written regardless, and Cursor says the attacker server has since been taken offline. Hunt leads, false-positive expectations and indicators are detailed below; no YARA or Sigma rules were published by the sources.
ATT&CK chain: Initial Access → Execution → Persistence → Discovery → Command and Control
Hunt Lead Grid
| Hunt Lead Level | Hunt Lead Name | ATT&CK | Risk of False Positives |
|---|---|---|---|
| 1 (Junior) | svc-telemetry Authorized Key Sweep | T1098.004 (Account Manipulation: SSH Authorized Keys) | Low. The match anchors on the exact key fingerprint and the svc-telemetry comment, which no legitimate tooling is known to use; a comment-only match should still be confirmed against the fingerprint. |
| 1 (Junior) | Masqueraded Persistence Artifact Sweep | T1543.001 (Create or Modify System Process: Launch Agent), T1053.005 (Scheduled Task/Job: Scheduled Task), T1053.003 (Scheduled Task/Job: Cron), T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder) | Low. Apple does not ship a per-user LaunchAgent labeled com.apple.sysmond, and the .smt/.smtk file pair is specific to this payload; a SysMon task name alone can collide with Sysinternals Sysmon deployments, so match it together with smt.cmd as the action. |
| 1 (Junior) | Extension Version and C2 Infrastructure Sweep | T1176.002 (Software Extensions: IDE Extensions), T1071.001 (Application Layer Protocol: Web Protocols) | Low. Version 2.1.313 in a Cursor extensions directory and any connection to 134.209.82[.]225 on TCP 22 or 8099 are campaign-specific; lookups to ifconfig.me and api.ipify.org are not indicators on their own and should not be alerted on. |
| 2 (Pro) | Reverse SSH Tunnel to Localhost 22 | T1572 (Protocol Tunneling) | Medium. Developers and administrators do run ssh -R and autossh for legitimate remote access, so the rule anchors on the combination of a wildcard bind with remote port 0 forwarding to local port 22, host-key checking disabled and an identity file in a temp directory. |
| 3 (Elite) | Editor Extension Host Spawning SSH and Persistence Commands | T1176.002 (Software Extensions: IDE Extensions), T1098.004 (Account Manipulation: SSH Authorized Keys) | Medium. Extensions legitimately spawn git, language servers and occasionally ssh for remote development, so the rule needs a baseline of normal extension-host children and fires on writes to authorized_keys or service and task creation in the same process tree. |
svc-telemetry Authorized Key Sweep
Within seconds of the extension’s webview opening, the loader created ~/.ssh with mode 0700 if needed, set authorized_keys to 0600 and appended the attacker’s public key, ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDdvylCEJ/k2TpezcTfedrkHyFSK9IZ3vmP6vhY4Ss0P svc-telemetry, fingerprint SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk. If the marker was already present it did not add it twice. Cursor says this step ran even on hosts where enabling the SSH server failed, which makes the key the most reliable sign that 2.1.313 executed. The detection is a file-content sweep of every user’s ~/.ssh/authorized_keys on macOS and Linux, and of %USERPROFILE%\.ssh\authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys on Windows, for the comment string and the key body, then confirming hits by computing the fingerprint.
Run it through EDR live-response or a fleet query tool across all developer workstations and any build or jump hosts where Cursor is installed, not only machines whose owners remember updating, since auto-update pulled the version silently. A one-time sweep is enough for the October 29 window, but keep a recurring check for the fingerprint for 90 days in case the key was copied to other hosts after access. File-integrity monitoring on authorized_keys is the right longer-term control; blocking the IP alone is the wrong one, because the key stays valid for any future tunnel endpoint. Any hit means the host is affected: isolate it, preserve the file and the SSH and authentication logs before removing the key, and escalate to incident response rather than just deleting the line.
Hunt Lead Level: 1 (Junior Analyst)
ATT&CK: Persistence → T1098.004 (Account Manipulation: SSH Authorized Keys)
Sources: “Trojanized Claude Code extension plants persistent SSH backdoor”, OpenSourceMalware, Oct. 30, 2026, https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor (additional source; key, fingerprint, file modes); “Security notice: malicious Anthropic.claude-code 2.1.313 in the Cursor Marketplace”, Cursor, Oct. 29, 2026, https://cursor.com/blog/claude-code-extension-security-notice (additional source; Windows key paths and affected check); “Official Claude Code VS Code Extension Compromised to Install Persistent SSH Backdoor”, The Hacker News, Oct. 30, 2026, https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html (source article)
Masqueraded Persistence Artifact Sweep
To keep the tunnel alive, the payload wrote a tunnel-loop script and a copy of the embedded private key and registered them to start automatically, retrying roughly every 60 seconds. On macOS it wrote ~/.config/.smt and ~/.config/.smtk and a LaunchAgent at ~/Library/LaunchAgents/com.apple.sysmond.plist (label com.apple.sysmond, RunAtLoad and KeepAlive, loaded with launchctl load -w). On Linux it wrote the same files and added an @reboot crontab entry. On Windows it wrote %USERPROFILE%\.config\smt.cmd and %USERPROFILE%\.config\smtk, created a scheduled task named SysMon with an on-start trigger that attempts to run as SYSTEM (schtasks /create /tn SysMon), and fell back to %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd. The decoded tunnel key was also dropped as $TMPDIR/.stk_<10 hex> (macOS/Linux) or %TEMP%\.stk_<10 hex> (Windows). The detection is a sweep for these exact paths, the LaunchAgent label, the task name with smt.cmd in its action, and any crontab @reboot line referencing .smt.
Use EDR file inventory, osquery tables for launchd, crontab and scheduled tasks, or Windows task scheduler event logs (event 4698 for task creation, Microsoft-Windows-TaskScheduler/Operational 106) on hosts that ran Cursor. Scope the sweep to October 29 onward. The Sysinternals Sysmon service uses a similar name, so never match on the task name alone, and do not “fix” a hit by deleting the plist or task: Cursor warns that uninstalling the extension does not remove these standalone scripts, and evidence should be collected first. Cursor publishes remediate-macos.sh (run as the affected user) and remediate-windows.ps1 (run as Administrator) for cleanup once triage is done. A hit on any of these artifacts confirms execution and should be handled exactly like a key hit. The pattern of an Apple-looking label in a user LaunchAgents folder generalizes well beyond this campaign and is worth a standing rule.
Hunt Lead Level: 1 (Junior Analyst)
ATT&CK: Persistence → T1543.001 (Create or Modify System Process: Launch Agent), T1053.005 (Scheduled Task/Job: Scheduled Task), T1053.003 (Scheduled Task/Job: Cron), T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder); Defense Evasion → T1036.004 (Masquerading: Masquerade Task or Service)
Sources: “Trojanized Claude Code extension plants persistent SSH backdoor”, OpenSourceMalware, Oct. 30, 2026, https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor (additional source); “Security notice: malicious Anthropic.claude-code 2.1.313 in the Cursor Marketplace”, Cursor, Oct. 29, 2026, https://cursor.com/blog/claude-code-extension-security-notice (additional source; Windows paths, remediation scripts)
Extension Version and C2 Infrastructure Sweep
The malicious code shipped only in the Cursor Marketplace build of anthropic.claude-code 2.1.313; Cursor lists the darwin-arm64 and win32-x64 VSIX packages by hash (see the appendix) and says the modified extension.js contains the attacker IP and the string svc-telemetry. About 1.5 seconds after loading, the loader looked up the host’s public IP via ifconfig.me and api.ipify.org, then POSTed a JSON beacon over unencrypted HTTP to hxxp://134.209.82[.]225:8099/beacon (and to 127.0.0.1:8099/beacon), and the tunnel connected as user tunnel to the same IP on TCP 22. The detection is twofold: an inventory query for an extension folder named anthropic.claude-code-2.1.313* under Cursor’s extensions directory (or for extension.js containing both strings), and a network log search for any connection to 134.209.82[.]225 on ports 22 or 8099.
Use software-inventory or EDR file search for the folder, and firewall, proxy or NetFlow logs for the IP, from October 29 onward. Cursor says the server is offline now, so absence of fresh traffic proves nothing; the retrospective window is what matters. Do not block or alert on ifconfig.me or api.ipify.org, which many legitimate tools use. Hash-blocking the two VSIX files is fine but narrow, since other platform builds were not hashed publicly; the folder name and string match cover them. A version hit without a key or persistence hit still warrants the full artifact sweep on that host, and a network hit is proof of execution and goes straight to incident response.
Hunt Lead Level: 1 (Junior Analyst)
ATT&CK: Persistence → T1176.002 (Software Extensions: IDE Extensions); Command and Control → T1071.001 (Application Layer Protocol: Web Protocols); Discovery → T1082 (System Information Discovery)
Sources: “Security notice: malicious Anthropic.claude-code 2.1.313 in the Cursor Marketplace”, Cursor, Oct. 29, 2026, https://cursor.com/blog/claude-code-extension-security-notice (additional source; VSIX hashes, network indicators); “Trojanized Claude Code extension plants persistent SSH backdoor”, OpenSourceMalware, Oct. 30, 2026, https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor (additional source; beacon timing); “Official Claude Code VS Code Extension Compromised to Install Persistent SSH Backdoor”, The Hacker News, Oct. 30, 2026, https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html (source article)
Reverse SSH Tunnel to Localhost 22
The tunnel is what turns the planted key into access: the payload ran autossh -M 0 if available, otherwise ssh, with -N -R '*:0:localhost:22', so the attacker’s server allocated a port that forwarded straight back to the victim’s own SSH daemon, using the decoded identity file from the temp directory. Cursor lists the options StrictHostKeyChecking=no, UserKnownHostsFile=/dev/null, ServerAliveInterval=30, ServerAliveCountMax=3, ExitOnForwardFailure=yes and IdentitiesOnly=yes, and the loop reconnected every 60 seconds. The detection logic is a process-creation rule for ssh or autossh whose command line contains a remote forward (-R) targeting localhost:22 or 127.0.0.1:22, combined with host-key checking disabled or an -i identity path under a temp directory or a dot-prefixed file such as .stk_ or .smtk.
Use EDR process telemetry or Linux auditd execve records, and scope first to developer and build workstations. Expect some legitimate reverse tunnels from administrators and remote-development setups; allowlist by known destination hosts and named identity files in ~/.ssh, not by user, and keep the generic “reverse forward to local port 22 with host-key checking off” condition as the alert because that combination is rare in normal use. Sweep 90 days of process history if you have it, both for this campaign and because the same technique is common in developer-targeted malware. A hit pointing at an unknown host should be treated as an active backdoor: capture the process tree and destination, then contain the host.
Hunt Lead Level: 2 (Pro)
ATT&CK: Command and Control → T1572 (Protocol Tunneling); Lateral Movement → T1021.004 (Remote Services: SSH) (the inbound use of the tunnel by the operator)
Sources: “Security notice: malicious Anthropic.claude-code 2.1.313 in the Cursor Marketplace”, Cursor, Oct. 29, 2026, https://cursor.com/blog/claude-code-extension-security-notice (additional source; command line and options); “Trojanized Claude Code extension plants persistent SSH backdoor”, OpenSourceMalware, Oct. 30, 2026, https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor (additional source; autossh preference, 60-second reconnect)
Editor Extension Host Spawning SSH and Persistence Commands
Because the loader ran inside the editor’s extension host, every action it took descends from the Cursor process tree: writing authorized_keys, running sudo -n systemsetup -setremotelogin on on macOS, systemctl checks and service starts for sshd or ssh on Linux, PowerShell Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0 and service configuration on Windows, schtasks /create, launchctl load -w, crontab edits and the ssh/autossh tunnel itself. The detection logic is a sequence correlation on the editor’s extension-host process (the Electron/Node helper running under Cursor or VS Code): alert when, within a short window, its descendants write to an authorized_keys file and also create a scheduled task, LaunchAgent, cron entry or start or install an SSH server, or spawn an ssh process with a remote forward.
This needs EDR process lineage joined with file-write and task-creation events, plus a baseline of what extension hosts normally spawn in your environment (git, language servers, package managers, and ssh for remote-development extensions to known hosts). Build the baseline over 30 days, then alert on the persistence and key-write combination rather than on any single child process, which keeps noise manageable. Applying it to every IDE, not only Cursor, is the point: it covers the next poisoned extension in any marketplace, which hash or IP blocking cannot. A hit should be escalated immediately; there is no common legitimate reason for an editor extension to install an SSH server or add an authorized key.
Hunt Lead Level: 3 (Elite)
ATT&CK: Persistence → T1176.002 (Software Extensions: IDE Extensions), T1098.004 (Account Manipulation: SSH Authorized Keys); Initial Access → T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain)
Sources: “Security notice: malicious Anthropic.claude-code 2.1.313 in the Cursor Marketplace”, Cursor, Oct. 29, 2026, https://cursor.com/blog/claude-code-extension-security-notice (additional source; commands); “Trojanized Claude Code extension plants persistent SSH backdoor”, OpenSourceMalware, Oct. 30, 2026, https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor (additional source; per-OS SSH enablement)
Hash Appendix
Trojanized anthropic.claude-code 2.1.313 (Cursor Marketplace)
SHA-256 and MD5 for the VSIX packages come from Cursor’s notice; the extension.js and tunnel-key SHA-256 values come from OpenSourceMalware. The source article lists no hashes, and SHA-1 values were not published by either source; AlienVault OTX and VirusTotal were not queried in this run.
MD5s
da5469c4221775e9fe2e413e59ca7fd9 # anthropic.claude-code 2.1.313 darwin-arm64 VSIX (Cursor Marketplace)
bd3b71ddf3d0cc3af76249afd2c0eda1 # anthropic.claude-code 2.1.313 win32-x64 VSIX (Cursor Marketplace)
(not available) # extension.js (trojanized bundle)
(not available) # embedded tunnel private key -> $TMPDIR/.stk_* / ~/.config/.smtkSHA1s
(not available) # darwin-arm64 VSIX
(not available) # win32-x64 VSIX
(not available) # extension.js
(not available) # embedded tunnel private keySHA256s
432ccdee3801f99e52b8fe31f69ea9870118e96ea7ef9ecabed1479621b5ab62 # anthropic.claude-code 2.1.313 darwin-arm64 VSIX
3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081 # anthropic.claude-code 2.1.313 win32-x64 VSIX
ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15 # extension.js with 66-line loader prepended
7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278 # decoded tunnel private key -> $TMPDIR/.stk_* (also written as .smtk)References Appendix
- “Official Claude Code VS Code Extension Compromised to Install Persistent SSH Backdoor”, The Hacker News (Ravie Lakshmanan), Oct. 30, 2026, https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html (source article)
- “Trojanized Claude Code extension plants persistent SSH backdoor”, OpenSourceMalware, Oct. 30, 2026, https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor (loader analysis, key, persistence, hashes)
- “Security notice: malicious Anthropic.claude-code 2.1.313 in the Cursor Marketplace”, Cursor, Oct. 29, 2026, https://cursor.com/blog/claude-code-extension-security-notice (window, affected users, VSIX hashes, command lines, remediation)
- MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/