What happened

• Version 2.1.313 of the Claude Code extension (anthropic.claude-code) was served via the Cursor Marketplace from about 2:27 a.m. to 1:35 p.m. PT on Oct 29, 2026, reaching at most 5,000 users. [S1]
• A 66-line JS loader adds an attacker SSH key labeled 'svc-telemetry' to ~/.ssh/authorized_keys and tries to enable SSH. [S1][S2]
• It opens a reverse tunnel to 134.209.82[.]225 and installs persistence as a scheduled task, crontab entry or LaunchAgent. [S1][S2]
• It sends host recon, including the global Git email, over unencrypted HTTP to 134.209.82[.]225:8099/beacon. [S1][S2]
• Enabling SSH fails without admin rights on most macOS and Windows hosts. The key, persistence and beacon still occur. No follow-on payloads have been observed. [S1]

Timeline

Detect

svc-telemetry key in authorized_keys · FIM / EDR file events on ~/.ssh/authorized_keys

index=* (file_path="*/.ssh/authorized_keys" OR TargetFilename="*authorized_keys") "svc-telemetry" | stats count min(_time) as first max(_time) as last by host, user, file_path, process_name

A hit means: The attacker key was planted on this host. Treat the host as compromised and check whether SSH is enabled.

Traffic to C2 134.209.82.225 · Firewall / proxy / EDR network events

index=* (dest_ip="134.209.82.225" OR dest="134.209.82.225" OR url="*134.209.82.225*") | stats count min(_time) as first max(_time) as last by src_ip, user, dest_port, process_name, url

A hit means: Port 8099 means the beacon sent host recon. Other ports, especially an SSH session, suggest the reverse tunnel was established.

Persistence created by the IDE · EDR process/file events, Windows 4698, macOS LaunchAgents FIM

index=* earliest="10/29/2026:00:00:00" (parent_process_name="*Cursor*" OR process_name="*Cursor*") (process_name IN ("schtasks.exe","crontab","launchctl") OR EventCode=4698 OR file_path="*/Library/LaunchAgents/*") | stats count by host, user, process_name, command_line, file_path

A hit means: The Cursor process tree created a scheduled task, cron entry or LaunchAgent. This likely matches the loader's persistence.

Beacon pattern and IP lookup from IDE · Proxy

index=* ((dest_port=8099 uri_path="/beacon") OR (url="*api.ipify.org*" (process_name="*Cursor*" OR process_name="*node*"))) | stats count by src_ip, user, url, process_name

A hit means: This matches the beacon behaviour and should catch it if the C2 IP changes. An ipify request alone is weaker and needs corroboration.

Verify

• Confirm the extension version on the host is 2.1.313 and that it was installed from the Cursor Marketplace inside the Oct 29 window. [S1]
• A true positive should show the 'svc-telemetry' key together with an IDE-spawned persistence entry or traffic to 134.209.82.225. [S1]
• Benign look-alikes: legitimate tools calling api.ipify.org, admins adding SSH keys, and extensions creating scheduled tasks for updates. None of these should carry the 'svc-telemetry' label or point at the C2 IP.
• A running `git config --global user.email` is common in IDEs. Only count it when it sits in the same 2.1.313 extension-host process tree.

Scope

Affected

• anthropic.claude-code 2.1.313 installed via the Cursor Marketplace, about 2:27 a.m.–1:35 p.m. PT Oct 29, 2026 [S1]

Only if

• Installed or auto-updated in Cursor IDE from the Cursor Marketplace during the window [S1]
• Attacker SSH login through the tunnel requires the local SSH service to be enabled, which needs admin rights on most macOS/Windows hosts [S1]

Not affected if

• Extension is not at version 2.1.313 [S1]
• Extension was installed from Open VSX or the Microsoft VS Code Marketplace (per pipeline exposure data; confirm in [S1])

Fixed in: 2.1.314 (pipeline exposure data; confirm against [S2])

Enumerate

• Hosts with Cursor IDE installed and their extension versions and install times
• Developer users whose global Git email may have been sent in the beacon
• Hosts where SSH/sshd was enabled or running on Oct 29 or later
• Users with local admin rights among affected hosts
• Secrets reachable from affected user profiles: SSH keys, cloud tokens, repo credentials

Contain

• Block 134.209.82.225 at egress and alert on any further attempts. [S1]
• Before removing anything, preserve copies of authorized_keys, the persistence entries, the extension folder and network logs.
• Isolate hosts showing the key plus a tunnel or SSH connection.
• Remove or update the 2.1.313 extension. Pause extension auto-update in Cursor until the publisher's status is confirmed.
• As a precaution, rotate credentials reachable from hosts where SSH was enabled and the tunnel was seen. This cannot be undone, and the sources do not report credential theft.

Eradicate

• Delete the 'svc-telemetry' line from ~/.ssh/authorized_keys. [S1]
• Remove the scheduled task, crontab entry or LaunchAgent the loader created. [S1]
• Remove the 2.1.313 extension files. Disable SSH where it was enabled without a business need.
• Reimage hosts where the attacker had interactive SSH access.

Recover

• Before returning a host, confirm a clean extension version, no 'svc-telemetry' key and no IDE-created persistence.
• Afterwards, monitor for traffic to 134.209.82.225, port 8099 /beacon, and new authorized_keys writes from IDE processes.

Re-enter the loop when

• New IoCs (IPs, key labels, domains) or follow-on payloads are reported
• Another marketplace or extension version is found trojanized
• Anthropic or Cursor publish an advisory that changes the window, the version or the reach figure
• Any hunt finds a successful SSH session through the tunnel

Debrief

• Record affected hosts, install times, the source marketplace and whether SSH was enabled on each.
• Record whether extension auto-update and marketplace sourcing are controlled for developer IDEs.
• Gap: no official advisory from Anthropic or Cursor is quoted directly in the inputs.
• Gap: how the build entered the Cursor Marketplace (publisher account compromise or marketplace issue) is not stated.

Detection coverage — checked automatically

Checked automatically 2026-10-30 13:07Z from public sources: 10 published, 8 nothing found, 1 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

No CVE in this campaign: nothing an internet scanner keys on. Scope by product in your own tool.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-10-30 13:07Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• The behaviour quotes are attributed to [S2], the GitHub releases page, but read like news text. Does Anthropic's own page confirm the incident and the details?
• Fixed version 2.1.314 and the Open VSX/Microsoft exclusion come from pipeline exposure data, not the story text. Confirm with the vendor.
• How was the malicious build published to the Cursor Marketplace?
• Has Anthropic or Cursor published an official advisory or removal notice?
• What else does the beacon collect beyond the Git email?

Sources

• [S1] https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html · The Hacker News
• [S2] https://github.com/anthropics/claude-code/releases · GitHub

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically once it crosses the publish bar.