I’M UNDER A CYBER ATTACK

Alert

Alert 2026-132 Trojanized version of the Claude Code extension in the Cursor marketplace installs an SSH backdoor

Affected product(s): 

ProductAffected versionsFixed version
Claude Code extension for VS Code (anthropic.claude-code) distributed through the Cursor extension marketplace2.1.313 (only), installed or updated on October 29, 2026 between 06:27 and 17:35 (PYT, UTC-3)2.1.314 or later

This affects Cursor users who installed or updated the extension during that window, including through automatic updates; there is no evidence that other distribution channels or other marketplace extensions were affected.

Description

A trojanized version of the official Claude Code extension for VS Code, identified as anthropic.claude-code 2.1.313, was publicly distributed through the Cursor editor’s extension marketplace. For approximately 11 hours on October 29, 2026, this version attempted to install a persistent SSH backdoor on developers’ machines. This is a software supply chain compromise: the version used the extension’s legitimate identifier, but Cursor’s provider stated that it was not developed by Anthropic, the extension’s developer. The incident has no assigned CVE and is classified as HIGH severity.

The provider stated that up to 5,000 Cursor users received the trojanized version and that they would be contacted directly. This figure is the maximum number of exposed users, meaning those who installed or updated to 2.1.313; it is not the number of machines confirmed to have been compromised. The provider has not disclosed how many machines had the attacker’s key added or how many tunnels were successfully established.

The provider removed the version, blocked its distribution, and shut down the entire marketplace as a precaution. It then audited access, confirmed that no other extension had been altered, rotated its keys, rebuilt the marketplace, and brought it back online. In addition, the attacker’s server was decommissioned by its cloud provider. How the package was introduced into the marketplace has not been disclosed, and the attack has not been attributed to any actor. There is no evidence that version 2.1.313 was distributed through npm, the Microsoft Visual Studio Marketplace, or the Open VSX registry.

Researchers point out that the package contains a 66-line loader prepended to the legitimate extension.js file. This code runs when the editor loads the extension, without user interaction or installation scripts, and suppresses its errors so that the extension continues to operate normally. The identified packages correspond to macOS (Apple Silicon) and Windows (x64), and the malicious code also includes a branch for Linux. When run, it:

  • Collects the machine name, username, operating system and architecture, home and working directories, configured Git email address, public IP address, and the names (not the values) of up to 40 environment variables containing KEY, TOKEN, SECRET, PASS, AWS, or GCP.
  • Adds the attacker’s SSH key, with the comment svc-telemetry, to the ~/.ssh/authorized_keys file and attempts to enable the local SSH service.
  • Opens a reverse SSH tunnel to 134.209.82.225 (port 22), retrying approximately every 60 seconds, and makes it persistent through a LaunchAgent on macOS, a scheduled task or startup script on Windows, and, according to researchers’ analysis, an @reboot entry in the crontab on Linux.
  • Sends the collected data via HTTP to 134.209.82.225:8099/beacon. It does not download a second stage.

The provider notes that enabling the SSH service requires administrator privileges, which the extension does not have on most macOS and Windows machines. On those machines, the step fails and the attacker cannot log in through the tunnel unless the editor is running as administrator. Nevertheless, installation of the attacker’s key, persistence, and data exfiltration are completed. Researchers warn that if the machine already had SSH remote access enabled, or it is enabled later, the backdoor will be operational. Since the attacker’s server is offline, the tunnel and data transmission no longer function. To date, no attacker access to machines or data theft beyond reconnaissance information has been publicly confirmed, although the provider warns that subsequent access to credentials through the backdoor cannot be ruled out.

Mitigation

To determine whether a machine is affected, check whether the svc-telemetry key is present using the commands published by the provider. According to researchers’ analysis, the same check used for macOS is also applicable to Linux.

# macOS (y Linux, según el análisis de investigadores)
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"
# Windows (PowerShell)
$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }

You can also check whether the ~/.cursor/extensions/anthropic.claude-code-2.1.313-* directory exists. Uninstalling the extension may not be sufficient because persistence operates separately. As general recommendations, on machines where version 2.1.313 was installed:

  • Search endpoint, network, and extension-installation telemetry for indicators of compromise, including historical connections to 134.209.82.225.
  • Isolate machines with evidence and preserve the evidence (SSH, process, and network logs) before cleaning them.
  • Block 134.209.82.225 on ports 22 and 8099.
  • Check the SSH logs for logins from 127.0.0.1 or ::1 using the svc-telemetry key. If the tunnel is confirmed to have connected, rebuilding the machine is recommended instead of cleaning it.
  • Check whether SSH remote access (Remote Login on macOS) was enabled without authorization.
  • If version 2.1.313 appears to be installed in any other editor, run the checks regardless.

Indicators of compromise

Network

  • Attacker IP address: 134.209.82[.]225, over TCP 22 (user tunnel) and TCP 8099 (POST /beacon).
  • Local beacon attempt: 127.0.0.1:8099/beacon.
  • Queries to ifconfig.me and api.ipify.org are not indicators on their own because they are legitimate services. There are no malicious domains.

SSH

  • Unauthorized key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDdvylCEJ/k2TpezcTfedrkHyFSK9IZ3vmP6vhY4Ss0P svc-telemetry.
  • Key fingerprint: SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk.
  • Tunnel key fingerprint: SHA256:KOAU57+ZG6u3MG4WwzPzPX2O5YEe9qdOC1Bl+6MVyDQ (comment svc-telemetry-tun).
  • According to researchers, incoming logins through the tunnel appear in the SSH logs as originating from 127.0.0.1 or ::1 with the svc-telemetry key.

Files and persistence

  • macOS: ~/Library/LaunchAgents/com.apple.sysmond.plist (label com.apple.sysmond; not an Apple component), ~/.config/.smt, ~/.config/.smtk, and $TMPDIR/.stk_<10 hex characters>.
  • Windows: the SysMon scheduled task (attempts to run as SYSTEM), %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd, %USERPROFILE%\.config\smt.cmd, %USERPROFILE%\.config\smtk, %TEMP%\.stk_<10 hex characters>, and the attacker’s key in %USERPROFILE%\.ssh\authorized_keys or C:\ProgramData\ssh\administrators_authorized_keys.
  • Linux (according to researchers’ analysis): an @reboot entry in the user’s crontab that executes ~/.config/.smt, along with ~/.config/.smt, ~/.config/.smtk, and /tmp/.stk_*.
  • Extension directory: anthropic.claude-code-2.1.313-darwin-arm64 or anthropic.claude-code-2.1.313-win32-x64, whose extension.js contains 134.209.82.225 and svc-telemetry.

Processes

  • ssh -N -R '*:0:localhost:22' or autossh -M 0, with StrictHostKeyChecking=no, UserKnownHostsFile=/dev/null, IdentitiesOnly=yes, and BatchMode=yes.
  • schtasks /create /tn SysMon, systemsetup -setremotelogin on, and Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0.

Hashes (SHA-256)

  • VSIX darwin-arm64: 432ccdee3801f99e52b8fe31f69ea9870118e96ea7ef9ecabed1479621b5ab62
  • VSIX win32-x64: 3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081
  • Malicious extension.js: ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15
  • Tunnel private key (.stk_*): 7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278
  • smt.cmd (Windows, reported by a single source): 22f682d9ff55264e934d0f43fcfbb46d58be5cfb8fe1b3a7cbb38fe089c818b0

Remediation

Remediation consists of removing the backdoor using the scripts published by the provider and updating the extension to version 2.1.314 or later:

  • macOS: run the remediate-macos.sh script as the affected user, not as root: bash remediate-macos.sh. The script removes the tampered extension, persistence mechanisms, tunnel processes, and the attacker’s key. It exits with a nonzero code if anything remains pending and warns if a service is listening on local port 22.
  • Windows: run the remediate-windows.ps1 script from a PowerShell console opened as administrator, with all editors closed: powershell -ExecutionPolicy Bypass -File .\remediate-windows.ps1. The script cleans all profiles on the machine.
  • Linux: there is no official script. According to researchers’ analysis, manual cleanup consists of removing the @reboot entry that executes ~/.config/.smt from the crontab (and checking whether any legitimate scheduled jobs were lost, because a failure in the malicious code may delete them), terminating the associated processes with pkill -f '\.stk_|\.config/\.smtk|\.config/\.smt', deleting ~/.config/.smt, ~/.config/.smtk, and /tmp/.stk_*, removing the svc-telemetry key from ~/.ssh/authorized_keys, and checking whether the SSH service was enabled.
  • From a trusted machine, rotate the credentials and sessions accessible from the affected machine: GitHub and GitLab tokens, CI/CD and package registry tokens, cloud keys, and SSH keys, prioritizing environment variables whose names contain KEY, TOKEN, SECRET, PASS, AWS, or GCP.

Additional information: