Researchers disclose trojanized Claude Code extension with persistent SSH backdoor on Cursor’s marketplace

Security researchers disclosed that attackers trojanized Anthropic’s official Claude Code extension and distributed malicious version 2.1.313 as a legitimate update through Cursor’s marketplace on Oct. 29, 2026, exposing at most 5,000 users to a persistent SSH backdoor for roughly 11 hours.::Security researchers disclosed that attackers trojanized Anthropic’s official Claude Code extension and distributed malicious version 2.1.313 as a legitimate update through Cursor’s marketplace on Oct. 29, 2026, exposing at most 5,000 users to a persistent SSH backdoor for roughly 11 hours.::Security researchers disclosed that attackers trojanized Anthropic’s official Claude Code extension and distributed malicious version 2.1.313 as a legitimate update through Cursor’s marketplace on Oct. 29, 2026, exposing at most 5,000 users to a persistent SSH backdoor for roughly 11 hours.::Security researchers disclosed that attackers trojanized Anthropic’s official Claude Code extension and distributed malicious version 2.1.313 as a legitimate update through Cursor’s marketplace on Oct. 29, 2026, exposing at most 5,000 users to a persistent SSH backdoor for roughly 11 hours.

Once loaded, the extension drops an attacker-controlled SSH key tagged svc-telemetry into the user’s authorized_keys file and tries a reverse SSH tunnel to 134.209.82.225. Even when the tunnel fails, the extension installs persistence, sends host details, and adds the key anyway, and it activates once VS Code starts and when its webview opens. A malicious 66-line loader runs ahead of the legitimate code inside the package‘s main JavaScript bundle, and the extension collects the hostname, the local username, the operating system and CPU architecture, the home and working directories, the public IP address, and the global Git e-mail address. It records as many as 40 environment-variable names when they contain KEY, TOKEN, SECRET, PASS, AWS, or GCP, but no other follow-on payloads have been observed.::Once loaded, the extension drops an attacker-controlled SSH key tagged svc-telemetry into the user’s authorized_keys file and tries a reverse SSH tunnel to 134.209.82.225. Even when the tunnel fails, the extension installs persistence, sends host details, and adds the key anyway, and it activates once VS Code starts and when its webview opens. A malicious 66-line loader runs ahead of the legitimate code inside the package’s main JavaScript bundle, and the extension collects the hostname, the local username, the operating system and CPU architecture, the home and working directories, the public IP address, and the global Git e-mail address. It records as many as 40 environment-variable names when they contain KEY, TOKEN, SECRET, PASS, AWS, or GCP, but no other follow-on payloads have been observed.::Once loaded, the extension drops an attacker-controlled SSH key tagged svc-telemetry into the user’s authorized_keys file and tries a reverse SSH tunnel to 134.209.82.225. Even when the tunnel fails, the extension installs persistence, sends host details, and adds the key anyway, and it activates once VS Code starts and when its webview opens. A malicious 66-line loader runs ahead of the legitimate code inside the package’s main JavaScript bundle, and the extension collects the hostname, the local username, the operating system and CPU architecture, the home and working directories, the public IP address, and the global Git e-mail address. It records as many as 40 environment-variable names when they contain KEY, TOKEN, SECRET, PASS, AWS, or GCP, but no other follow-on payloads have been observed.::Once loaded, the extension drops an attacker-controlled SSH key tagged svc-telemetry into the user’s authorized_keys file and tries a reverse SSH tunnel to 134.209.82.225. Even when the tunnel fails, the extension installs persistence, sends host details, and adds the key anyway, and it activates once VS Code starts and when its webview opens. A malicious 66-line loader runs ahead of the legitimate code inside the package’s main JavaScript bundle, and the extension collects the hostname, the local username, the operating system and CPU architecture, the home and working directories, the public IP address, and the global Git e-mail address. It records as many as 40 environment-variable names when they contain KEY, TOKEN, SECRET, PASS, AWS, or GCP, but no other follow-on payloads have been observed.

On most macOS and Windows hosts, the extension lacks the administrator rights needed to enable the local SSH service, so the attacker could not use the tunnel to log in. Once the editor closes, the tunnel stays up and the malware attempts to reconnect roughly every 60 seconds. Persistence is platform-specific: Windows uses a scheduled task, Linux uses a crontab scheduler, and macOS uses a LaunchAgent, the system’s auto-start agent. Specific traces include a LaunchAgent labeled com.apple.sysmond on macOS, a scheduled task named SysMon on Windows, and a Startup-folder script named sysmon.cmd.::On most macOS and Windows hosts, the extension lacks the administrator rights needed to enable the local SSH service, so the attacker could not use the tunnel to log in. Once the editor closes, the tunnel stays up and the malware attempts to reconnect roughly every 60 seconds. Persistence is platform-specific: Windows uses a scheduled task, Linux uses a crontab scheduler, and macOS uses a LaunchAgent, the system’s auto-start agent. Specific traces include a LaunchAgent labeled com.apple.sysmond on macOS, a scheduled task named SysMon on Windows, and a Startup-folder script named sysmon.cmd.::On most macOS and Windows hosts, the extension lacks the administrator rights needed to enable the local SSH service, so the attacker could not use the tunnel to log in. Once the editor closes, the tunnel stays up and the malware attempts to reconnect roughly every 60 seconds. Persistence is platform-specific: Windows uses a scheduled task, Linux uses a crontab scheduler, and macOS uses a LaunchAgent, the system’s auto-start agent. Specific traces include a LaunchAgent labeled com.apple.sysmond on macOS, a scheduled task named SysMon on Windows, and a Startup-folder script named sysmon.cmd.::On most macOS and Windows hosts, the extension lacks the administrator rights needed to enable the local SSH service, so the attacker could not use the tunnel to log in. Once the editor closes, the tunnel stays up and the malware attempts to reconnect roughly every 60 seconds. Persistence is platform-specific: Windows uses a scheduled task, Linux uses a crontab scheduler, and macOS uses a LaunchAgent, the system’s auto-start agent. Specific traces include a LaunchAgent labeled com.apple.sysmond on macOS, a scheduled task named SysMon on Windows, and a Startup-folder script named sysmon.cmd.

Cursor identified 134.209.82.225 as the attacker endpoint, describing it as a reverse SSH target for TCP port 22, and it identified port 8099 as an external beacon; the extension posted host details to 134.209.82.225:8099/beacon over unencrypted HTTP and collected the public IP address through api.ipify.org. It also listed the unauthorized ssh-ed25519 public key fingerprint SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk and partnered with the cloud provider hosting the attacker’s server to shut it down, disabling the reverse shell and the host-detail POST.::Cursor identified 134.209.82.225 as the attacker endpoint, describing it as a reverse SSH target for TCP port 22, and it identified port 8099 as an external beacon; the extension posted host details to 134.209.82.225:8099/beacon over unencrypted HTTP and collected the public IP address through api.ipify.org. It also listed the unauthorized ssh-ed25519 public key fingerprint SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk and partnered with the cloud provider hosting the attacker’s server to shut it down, disabling the reverse shell and the host-detail POST.::Cursor identified 134.209.82.225 as the attacker endpoint, describing it as a reverse SSH target for TCP port 22, and it identified port 8099 as an external beacon; the extension posted host details to 134.209.82.225:8099/beacon over unencrypted HTTP and collected the public IP address through api.ipify.org. It also listed the unauthorized ssh-ed25519 public key fingerprint SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk and partnered with the cloud provider hosting the attacker’s server to shut it down, disabling the reverse shell and the host-detail POST.::Cursor identified 134.209.82.225 as the attacker endpoint, describing it as a reverse SSH target for TCP port 22, and it identified port 8099 as an external beacon; the extension posted host details to 134.209.82.225:8099/beacon over unencrypted HTTP and collected the public IP address through api.ipify.org. It also listed the unauthorized ssh-ed25519 public key fingerprint SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk and partnered with the cloud provider hosting the attacker’s server to shut it down, disabling the reverse shell and the host-detail POST.

Deleting the extension may not suffice, since the payload leaves standalone scripts that continue to run. Cursor issued remediation scripts named remediate-macos.sh and remediate-windows.ps1; the macOS script must run as the affected user, while the Windows script must run from an administrator PowerShell session. Anyone who installed version 2.1.313 while it was exposed should isolate affected hosts, rotate credentials and sessions, and remove the attacker’s SSH key along with its persistence mechanisms. Cursor’s impact check searches the SSH authorized_keys file for the attacker’s public key tagged svc-telemetry: it uses grep on macOS, while on Windows it runs PowerShell.::Deleting the extension may not suffice, since the payload leaves standalone scripts that continue to run. Cursor issued remediation scripts named remediate-macos.sh and remediate-windows.ps1; the macOS script must run as the affected user, while the Windows script must run from an administrator PowerShell session. Anyone who installed version 2.1.313 while it was exposed should isolate affected hosts, rotate credentials and sessions, and remove the attacker’s SSH key along with its persistence mechanisms. Cursor’s impact check searches the SSH authorized_keys file for the attacker’s public key tagged svc-telemetry: it uses grep on macOS, while on Windows it runs PowerShell.::Deleting the extension may not suffice, since the payload leaves standalone scripts that continue to run. Cursor issued remediation scripts named remediate-macos.sh and remediate-windows.ps1; the macOS script must run as the affected user, while the Windows script must run from an administrator PowerShell session. Anyone who installed version 2.1.313 while it was exposed should isolate affected hosts, rotate credentials and sessions, and remove the attacker’s SSH key along with its persistence mechanisms. Cursor’s impact check searches the SSH authorized_keys file for the attacker’s public key tagged svc-telemetry: it uses grep on macOS, while on Windows it runs PowerShell.::Deleting the extension may not suffice, since the payload leaves standalone scripts that continue to run. Cursor issued remediation scripts named remediate-macos.sh and remediate-windows.ps1; the macOS script must run as the affected user, while the Windows script must run from an administrator PowerShell session. Anyone who installed version 2.1.313 while it was exposed should isolate affected hosts, rotate credentials and sessions, and remove the attacker’s SSH key along with its persistence mechanisms. Cursor’s impact check searches the SSH authorized_keys file for the attacker’s public key tagged svc-telemetry: it uses grep on macOS, while on Windows it runs PowerShell.

Cursor pulled the malicious version as soon as it detected the problem and shut the entire marketplace down as a precaution. It reviewed access, confirmed that no other extensions had been tampered with, changed its keys, rebuilt the marketplace, and brought it back online. Cursor will contact affected users directly and directed questions to security@cursor.com. As of Oct. 30, 2026, Anthropic released version 2.1.314 on Open VSX and on Microsoft’s VS Code Marketplace.::Cursor pulled the malicious version as soon as it detected the problem and shut the entire marketplace down as a precaution. It reviewed access, confirmed that no other extensions had been tampered with, changed its keys, rebuilt the marketplace, and brought it back online. Cursor will contact affected users directly and directed questions to security@cursor.com. As of Oct. 30, 2026, Anthropic released version 2.1.314 on Open VSX and on Microsoft’s VS Code Marketplace.::Cursor pulled the malicious version as soon as it detected the problem and shut the entire marketplace down as a precaution. It reviewed access, confirmed that no other extensions had been tampered with, changed its keys, rebuilt the marketplace, and brought it back online. Cursor will contact affected users directly and directed questions to security@cursor.com. As of Oct. 30, 2026, Anthropic released version 2.1.314 on Open VSX and on Microsoft’s VS Code Marketplace.::Cursor pulled the malicious version as soon as it detected the problem and shut the entire marketplace down as a precaution. It reviewed access, confirmed that no other extensions had been tampered with, changed its keys, rebuilt the marketplace, and brought it back online. Cursor will contact affected users directly and directed questions to security@cursor.com. As of Oct. 30, 2026, Anthropic released version 2.1.314 on Open VSX and on Microsoft’s VS Code Marketplace.

The malicious update reached users only through Cursor’s marketplace, with no evidence that it appeared on Open VSX or on Microsoft’s official VS Code Marketplace. Microsoft’s Visual Studio Marketplace is the default extension store for VS Code, and no malicious version has surfaced there. Because they are built on the VS Code codebase, Cursor and Windsurf are blocked from Microsoft’s marketplace and turn to Open VSX instead.::The malicious update reached users only through Cursor’s marketplace, with no evidence that it appeared on Open VSX or on Microsoft’s official VS Code Marketplace. Microsoft’s Visual Studio Marketplace is the default extension store for VS Code, and no malicious version has surfaced there. Because they are built on the VS Code codebase, Cursor and Windsurf are blocked from Microsoft’s marketplace and turn to Open VSX instead.::The malicious update reached users only through Cursor’s marketplace, with no evidence that it appeared on Open VSX or on Microsoft’s official VS Code Marketplace. Microsoft’s Visual Studio Marketplace is the default extension store for VS Code, and no malicious version has surfaced there. Because they are built on the VS Code codebase, Cursor and Windsurf are blocked from Microsoft’s marketplace and turn to Open VSX instead.::The malicious update reached users only through Cursor’s marketplace, with no evidence that it appeared on Open VSX or on Microsoft’s official VS Code Marketplace. Microsoft’s Visual Studio Marketplace is the default extension store for VS Code, and no malicious version has surfaced there. Because they are built on the VS Code codebase, Cursor and Windsurf are blocked from Microsoft’s marketplace and turn to Open VSX instead.

Researchers at macOS security firm Phorion spotted version 2.1.313 of the malicious package on Open VSX, but Ax Sharma, Head of Research at Manifold Security, disputes the claim that the Open VSX version was compromised, saying what ran in Cursor’s marketplace was the legitimate Claude Code extension. Early reporting described the Open VSX registry extension as compromised, though the incident was later traced to the Cursor VS Code Marketplace. Cursor said other Cursor marketplace extensions, including Grok Bot, Grok, and SpaceXSI products, are not affected by the incident.::Researchers at macOS security firm Phorion spotted version 2.1.313 of the malicious package on Open VSX, but Ax Sharma, Head of Research at Manifold Security, disputes the claim that the Open VSX version was compromised, saying what ran in Cursor’s marketplace was the legitimate Claude Code extension. Early reporting described the Open VSX registry extension as compromised, though the incident was later traced to the Cursor VS Code Marketplace. Cursor said other Cursor marketplace extensions, including Grok Bot, Grok, and SpaceXSI products, are not affected by the incident.::Researchers at macOS security firm Phorion spotted version 2.1.313 of the malicious package on Open VSX, but Ax Sharma, Head of Research at Manifold Security, disputes the claim that the Open VSX version was compromised, saying what ran in Cursor’s marketplace was the legitimate Claude Code extension. Early reporting described the Open VSX registry extension as compromised, though the incident was later traced to the Cursor VS Code Marketplace. Cursor said other Cursor marketplace extensions, including Grok Bot, Grok, and SpaceXSI products, are not affected by the incident.::Researchers at macOS security firm Phorion spotted version 2.1.313 of the malicious package on Open VSX, but Ax Sharma, Head of Research at Manifold Security, disputes the claim that the Open VSX version was compromised, saying what ran in Cursor’s marketplace was the legitimate Claude Code extension. Early reporting described the Open VSX registry extension as compromised, though the incident was later traced to the Cursor VS Code Marketplace. Cursor said other Cursor marketplace extensions, including Grok Bot, Grok, and SpaceXSI products, are not affected by the incident.

Ax Sharma, Head of Research at Manifold Security, said these things are increasingly being installed by automatic updates and agents instead of by humans, while security researcher Paul McCarty said the beacon leaves out environment-variable values themselves and that those names expose which cloud providers, CI systems, and credential types are set up.

Checking the publisher name doesn't help when the publisher is real

Ax Sharma, Head of Research at Manifold Security, Help Net Security

, Sharma said. How attackers introduced the unauthorized update remains unknown to researchers. Cursor stated,

This malicious version of the extension was not developed by Anthropic

Cursor, The Hacker News

, and said that extensions besides this one, downloaded from its marketplace, were not affected.::, and said that extensions besides this one, downloaded from its marketplace, were not affected.::, and said that extensions besides this one, downloaded from its marketplace, were not affected.::, and said that extensions besides this one, downloaded from its marketplace, were not affected.