Cursor Marketplace Compromise: Malicious Claude Code Extensions Attempt SSH Backdoor Installation

1. Basic Information

• Article Name: Security notice — malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace
• Published By: Cursor
• Published Date: 2026-10-29
• Original Update: 2026-10-30 11:30 PT (Clarified affected versions and IOCs)
• Original Source: Cursor
• Related Sources: BleepingComputer
• Related Malware: Modified Claude Code Extension
• Related Threat Actor: None specified
• Related CVE: None specified
• Related Products: Cursor, Cursor Marketplace, Claude Code Extension
• Severity: Critical

2. Quick Summary

Two modified versions of the Claude Code extension for Windows and macOS were distributed on the Cursor Marketplace for about 11 hours, attempting to transmit device information, add SSH keys, establish persistence, and open a reverse tunnel. Cursor's initial notice stated that up to 5,000 users may have been affected.

3. Attack Flow

From Modified Extension to Remote Access

1. Install the modified versions 2.1.312 or 2.1.313 for Windows or macOS from the Cursor Marketplace.
2. When the extension loads, it collects host, user, Git, and environment information and sends it to the C2 server.
3. It adds an SSH public key and attempts to enable the SSH service and establish a reverse tunnel.
4. It establishes persistence for reconnection through a macOS LaunchAgent or a Windows scheduled task / Startup entry. The payload also contains a Linux cron branch, but that does not establish that a modified Linux package was distributed; the identified packages target Windows and macOS.

4. Attacker Position and Execution Location

• Exploits the Marketplace distribution channel to execute code as an extension on developer endpoints.
• Aims to connect from the C2 side via a reverse SSH tunnel.

5. Victim and Administrator Perspective

Victim Perspective

• Appears as a normal Claude Code extension update, and once the extension is installed and loaded, its startup code can execute without further user interaction.

Administrator Perspective

• Indicators include HTTP traffic to 134.209.82[.]225:8099, outbound SSH traffic to that address on TCP port 22, changes to authorized_keys, com.apple.sysmond, SysMon tasks, and cron modifications.

6. Success and Failure Conditions

Success Conditions

• Installing or updating to a malicious version during the affected distribution window, followed by loading the extension.
• Permitting outbound communication to the C2 server, along with successfully adding an SSH key and establishing a reverse tunnel for remote access.

Failure Conditions and Mitigations

• Blocking the affected version before installation, or preventing the installed extension from loading, prevents its initial execution.
• Blocking C2 traffic, disabling the SSH service, or lacking privileges hinders remote login, though this does not guarantee that reconnaissance data transmission or artifact generation failed.

7. What Happens Upon Success

• External transmission of developer endpoint information.
• Potential remote access via added SSH keys and persistence.
• Subsequent risk of compromise to repositories, CI/CD pipelines, and cloud secrets.

8. Observable Logs

• Email: None specified
• Proxy / SWG / DNS: /beacon requests to 134.209.82[.]225:8099, outbound connections to TCP/22.
• Endpoint / EDR: Cursor extension 2.1.312/2.1.313, authorized_keys modifications with svc-telemetry, com.apple.sysmond, SysMon scheduled tasks, Startup scripts, and cron changes.
• Identity / IdP: New sessions or token usage for Git, cloud, and CI credentials.
• SaaS / Cloud: Repository access and secret usage tied to the Git email on affected endpoints.
• Network: HTTP POST requests and reverse SSH traffic to 134.209.82[.]225.

9. Attack Success Determination

• Confirming Initial Execution: Public information: Cursor confirmed that /beacon transmission after extension loading, SSH key additions, and persistence artifacts could occur. Verify these artifacts on individual endpoints (Scope: Developer endpoint).
• Confirming Subsequent Compromise: Criteria: Confirm SSH sessions from C2, repository access, and credential usage using separate evidence (Scope: Endpoint and developer services).

10. Investigation Playbook

• Trigger: Detection of the affected extension version, C2 communication, or the svc-telemetry key.
• Initial Checks: Verify installation/update timestamps, extension hash/version, Cursor Marketplace source, and time synchronization.
• Endpoint: Preserve authorized_keys, LaunchAgents, scheduled tasks, Startup entries, cron jobs, process trees, and network history.
• Identity / Cloud: Inspect tokens and sessions for Git, cloud, CI/CD, and package registries.
• Follow-on: Track repository clones, secret access, new keys, pipeline changes, and cloud APIs.
• Containment: Isolate endpoints showing signs of execution or backdoor installation, remove unauthorized SSH keys, persistence, and tunnel processes, and assess whether the endpoint should be rebuilt. From a trusted system, rotate credentials that were accessible from affected endpoints and revoke their sessions.
• Classification: Determine extension execution, persistence, reverse tunnel, interactive access, and secret abuse by phase.

11. Defense and Detection Ideas

• Single Event: Alert on authorized_keys modifications involving svc-telemetry and the installation of Cursor extension versions 2.1.312 or 2.1.313.
• Time-Series Correlation: Correlate extension installation and persistence creation with C2 reconnection attempts occurring approximately every 60 seconds.
• Hunting: Search all endpoints for 134.209.82[.]225, com.apple.sysmond, SysMon tasks, and the Cursor extension directory.
• Logging Gap: Lack of extension installation history or outbound SSH logs from developer endpoints leaves blind spots in the impact scope.
• Priority Controls: Prioritize extension allowlists, Marketplace provenance verification, shortening the lifespan of developer secrets, and egress filtering.

12. Facts, Inference, and Hypothesis

Facts

• Cursor stated that modified versions of the Claude Code extension (2.1.312 and 2.1.313) for Windows and macOS were distributed between 2026-10-29 02:27 and 13:35 PT. Cursor's initial notice put the potential impact at up to 5,000 users.
• Upon startup, the extension collected hostname, username, public IP, Git email, environment variable names, and directory information, sending it to /beacon at 134.209.82[.]225:8099.
• It added an SSH public key with the comment svc-telemetry to authorized_keys, and attempted to enable the SSH service and establish a TCP/22 reverse tunnel.
• It persisted reconnections using a macOS LaunchAgent (com.apple.sysmond), a Windows scheduled task (SysMon, attempting SYSTEM execution), or a Startup fallback, retrying approximately every 60 seconds. While IOCs also listed a Linux cron branch, the distributed packages targeted Windows and macOS.
• Cursor removed the malicious package, disabled the Marketplace, audited other extensions, performed key rotation, rebuilt the Marketplace, and shut down C2 infrastructure, stating there is no evidence of impact on official distributions or other extensions.
• Cursor explained that service activation and backdoor logins failed on many endpoints due to code errors and insufficient administrative privileges, though SSH key addition, persistence, and reconnaissance data transmission could still occur separately.

Inference

• Because repository and cloud credentials on development endpoints risk being impacted, actions must go beyond merely removing the extension; remaining keys and persistence mechanisms must be cleared, the need for system rebuilds evaluated, and secrets rotated.

Hypothesis

No additional hypotheses. Unconfirmed items are listed under Unknowns and Further Investigation.

13. MITRE ATT&CK Mapping

14. Unknowns and Limitations

• The specific threat actor, the injection pathway into the Marketplace, and the exact number of endpoints that successfully achieved interactive SSH access remain unknown.

15. Impact on SOCs and Organizations

Organizations running Cursor should check for installation history of the affected versions, the presence of the svc-telemetry key, communication with 134.209.82[.]225, and persistence artifacts. They should remove unauthorized SSH keys and persistence from affected endpoints, evaluate the need for system rebuilds, and rotate any credentials that were reachable.

16. Summary by Role

• SOC: Correlate Marketplace installation history with C2 traffic, SSH keys, and LaunchAgents/tasks/cron.
• Administrators: Isolate endpoints showing traces of compromise to remove keys and persistence, evaluate rebuild requirements, and rotate developer credentials.
• Users: If there is any possibility that the affected extension was installed from Cursor, stop using the device immediately and contact administrators.