Malicious Claude Code Extension Delivered SSH Backdoor in Cursor

A supply chain attack compromised Anthropic's Claude Code extension distributed through the Cursor VS Code extension marketplace, delivering a remote access trojan via an SSH reverse backdoor. Cursor says about 5,000 developer systems were impacted, and Anthropic later replaced version 2.1.313 with version 2.1.314.

What happened

The extension auto updated in Cursor to the malicious version. Phorion first noticed the malicious activity on endpoints. Anthropic has not informed customers, and the malicious version was silently deleted without telling anybody.

Malicious behavior

Cursor admitted the issue and said the extension runs malicious code that attempts to install a persistent SSH backdoor. It collects host and user information including hostname, username, OS, architecture, home directory path, environment variable names, working directories, configured Git email, and public IP. It attempts to add an attacker controlled SSH key to authorized_keys, enable the local SSH service, and open a reverse SSH tunnel. Outside highly unusual circumstances where Cursor was started with administrator privileges, errors in the malicious code mean this step would fail. It also attempts to make the reverse SSH tunnel persistent through a LaunchAgent on macOS or a scheduled task that attempts to run as SYSTEM with a Startup script fallback on Windows, while background scripts retry the tunnel roughly every 60 seconds. Host details and backdoor status are reported via HTTP POST to /beacon on port 8099.

Version and detection

The compromised version was 2.1.313. Anthropic replaced it on 30 October 2026 with 2.1.314, which appears to remove the backdoor from the extension, but it is not clear whether it still contains malicious code. The update does not remove the SSH backdoor from systems already infected, nor prior reconnaissance activity. Version 2.1.313 is missing from OpenVSX, the Visual Studio Marketplace, and Cursor. Kevin Beaumont published KQL queries for hunting the malicious version with Microsoft Defender for Endpoint.

Indicators and context

Network indicators include a reverse SSH tunnel to 134.209.82.225 on port 22 and a command and control endpoint at http://134.209.82.225:8099/beacon using HTTP POST. A local beacon attempt targets 127.0.0.1:8099/beacon. Public IP lookups to ifconfig.me and api.ipify.org are legitimate services, and access alone is not an indicator. File hashes include VSIX SHA 256 432ccdee3801f99e52b8fe31f69ea9870118e96ea7ef9ecabed1479621b5ab62 for darwin arm64 Mac and 3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081 for win32 x64. Cursor's blog includes wording that the malicious version was not developed by Anthropic, although it was uploaded under Anthropic's verified account. Notable customers who run Claude Code and Cursor on laptops include Binance, among thousands of others. The situation is emerging, and updates are being posted on Mastodon.

Sources: Doublepulsar · Phorion