/cards/ once it crosses the publish bar. Status: superseded. Supersedes version 2.Trojanized Claude Code extension 2.1.313 on Cursor Marketplace adds SSH key, persistence and beacon
A malicious Claude Code extension build (2.1.313) was distributed through the Cursor Marketplace for about 11 hours on Oct 29, 2026, reaching at most 5,000 users. Today, find any developer host that received it, then hunt for the 'svc-telemetry' SSH key, IDE-spawned persistence and traffic to 134.209.82.225.
Triage: The backdoor reached developer workstations through an auto-updating marketplace, and the reporting gives concrete artifacts to hunt today. [S1]
The core claims come from reputable secondary reporting [S1]. The pipeline attributes the artifact quotes to the vendor release page [S2], but the inputs do not show that page's text, so vendor confirmation is not verified.
Changed since version 2
- Added the eradicate and reenter_when sections, which were absent from the prior draft, using artifacts from [S1].
- Added coverage_checks per product category in place of the prior coverage feed listing.
- Added a confidence of medium with its reason: the [S1] claims are not yet confirmed directly from [S2] text.
- Reworded the advisory gap in debrief: the behaviors attribute quotes to [S2], but they are unverified.
- No sourced facts changed. Today's story matches version 2 on window, version, IoCs and behaviour. [S1]
What happened
- Version 2.1.313 of the Claude Code extension (anthropic.claude-code) was distributed via the Cursor Marketplace between about 2:27 a.m. and 1:35 p.m. PT on Oct 29, 2026, reaching at most 5,000 users. [S1]
- A 66-line JS loader adds an attacker SSH key labeled 'svc-telemetry' to ~/.ssh/authorized_keys and tries to enable SSH. [S1]
- It opens a reverse tunnel to 134.209.82[.]225 and installs persistence: a scheduled task, crontab entry or LaunchAgent. [S1]
- It beacons host recon, including the global Git email, over unencrypted HTTP to 134.209.82[.]225:8099/beacon. [S1]
- Enabling SSH fails without admin rights on most macOS and Windows hosts, but the key, persistence and beacon still occur. No follow-on payloads were observed. [S1]
Timeline
| 2026-10-29 ~02:27 PT | Malicious 2.1.313 becomes available via the Cursor Marketplace. S1 |
| 2026-10-29 ~13:35 PT | Distribution window ends. S1 |
| 2026-10-30 | Public reporting with IoCs and artifact details. S1 |
Detect
svc-telemetry key in authorized_keys · FIM / EDR file events on ~/.ssh/authorized_keys
index=* (file_path="*/.ssh/authorized_keys" OR TargetFilename="*authorized_keys") "svc-telemetry" | stats count min(_time) as first max(_time) as last by host, user, file_path, process_name
A hit means: The attacker key was planted on this host. Treat the host as compromised and check whether SSH is enabled.
Traffic to C2 134.209.82.225 · Firewall / proxy / EDR network events
index=* (dest_ip="134.209.82.225" OR dest="134.209.82.225" OR url="*134.209.82.225*") | stats count min(_time) as first max(_time) as last by src_ip, user, dest_port, process_name, url
A hit means: Port 8099 means the beacon sent host recon. Other ports, especially an SSH session, suggest the reverse tunnel was established.
Persistence created by the IDE · EDR process/file events, Windows 4698, macOS LaunchAgents FIM
index=* earliest="10/29/2026:00:00:00" (parent_process_name="*Cursor*" OR process_name="*Cursor*") (process_name IN ("schtasks.exe","crontab","launchctl") OR EventCode=4698 OR file_path="*/Library/LaunchAgents/*") | stats count by host, user, process_name, command_line, file_pathA hit means: The Cursor process tree created a scheduled task, cron entry or LaunchAgent. This likely matches the loader's persistence.
Beacon pattern and IP lookup from IDE · Proxy
index=* ((dest_port=8099 uri_path="/beacon") OR (url="*api.ipify.org*" (process_name="*Cursor*" OR process_name="*node*"))) | stats count by src_ip, user, url, process_name
A hit means: This matches the beacon behaviour and should catch it if the C2 IP changes. An ipify request alone is weaker and needs corroboration.
Verify
- Confirm the extension version on the host is 2.1.313 and that it was installed from the Cursor Marketplace inside the Oct 29 window. [S1]
- A true positive should show the 'svc-telemetry' key together with an IDE-spawned persistence entry or traffic to 134.209.82.225. [S1]
- Benign look-alikes: legitimate tools calling api.ipify.org, admins adding SSH keys, and extensions creating scheduled tasks for updates. None of these should carry the 'svc-telemetry' label or point at the C2 IP.
- A running `git config --global user.email` is common in IDEs. Only count it when it sits in the same 2.1.313 extension-host process tree.
Scope
Affected
- anthropic.claude-code 2.1.313 installed via the Cursor Marketplace, about 2:27 a.m.–1:35 p.m. PT Oct 29, 2026; at most 5,000 users [S1]
Only if
- Installed or auto-updated in Cursor IDE from the Cursor Marketplace during the window [S1]
- Attacker SSH login through the tunnel requires the local SSH service to be enabled, which needs admin rights on most macOS/Windows hosts [S1]
Not affected if
- Extension is not at version 2.1.313 [S1]
- Extension was installed from Open VSX or the Microsoft VS Code Marketplace (per pipeline exposure data; confirm in [S1])
Fixed in: 2.1.314 (pipeline exposure data; confirm against [S2])
Enumerate
- Hosts with Cursor IDE installed and their extension versions and install times
- Developer users whose global Git email may have been sent in the beacon
- Hosts where SSH/sshd was enabled or running on Oct 29 or later
- Users with local admin rights among affected hosts
- Secrets reachable from affected user profiles: SSH keys, cloud tokens, repo credentials
Contain
- Block 134.209.82.225 at egress and alert on any further attempts. [S1]
- Before removing anything, preserve copies of authorized_keys, the persistence entries, the extension folder and network logs.
- Isolate hosts showing the key plus a tunnel or SSH connection.
- Remove or update the 2.1.313 extension. Pause extension auto-update in Cursor until the publisher's status is confirmed.
- As a precaution, rotate credentials reachable from hosts where SSH was enabled and the tunnel was seen. This cannot be undone, and the sources report no credential theft or follow-on payloads. [S1]
Eradicate
- Remove the 'svc-telemetry' key from ~/.ssh/authorized_keys. [S1]
- Remove the loader's scheduled task, crontab entry or LaunchAgent. [S1]
- Uninstall 2.1.313 and reinstall a clean version from a verified source. [S1]
- Disable SSH where it was enabled by the loader rather than by the user.
Recover
- Before returning a host, confirm a clean extension version, no 'svc-telemetry' key and no IDE-created persistence.
- Afterwards, monitor for traffic to 134.209.82.225, port 8099 /beacon, and new authorized_keys writes from IDE processes.
Re-enter the loop when
- A new C2 address, key label or loader variant is reported.
- Follow-on payloads or credential theft are reported for this campaign.
- Other extension versions, other marketplaces (Open VSX, VS Code Marketplace) or other publishers are named as affected.
- Anthropic or Cursor publishes or changes an advisory, window or fixed version.
- A hunt hit appears on a host outside the Oct 29 install window.
Debrief
- Record affected hosts, install times, the source marketplace and whether SSH was enabled on each.
- Record whether extension auto-update and marketplace sourcing are controlled for developer IDEs.
- Gap: the pipeline attributes artifact quotes to the vendor release page [S2], but no Anthropic or Cursor text is shown directly in the inputs.
- Gap: how the build entered the Cursor Marketplace (publisher account compromise or marketplace issue) is not stated.
- Gap: the basis for the 'at most 5,000 users' figure is not given.
Detection coverage — checked automatically
| Category | Source | Status |
|---|---|---|
| Vendor | Impacted vendor / CERT advisory | published — primary source among the thread's sources: https://github.com/anthropics/claude-code/releases |
| Government | CISA KEV | not checkable — no CVE: the catalog is keyed by CVE |
| EDR / endpoint VM | CrowdStrike blog | nothing found — no post names it among the feed's 10 newest items |
| EDR / endpoint VM | Microsoft Security blog | published — Inside a malicious Claude Code-branded extension and its persistent SSH backdoor · Tracking AI adoption in North Korean threat actor tradecraft · Agents are your newest insiders. Security must move at their speed. (names the campaign in the title; the feed text carries no CVE id) |
| EDR / endpoint VM | SentinelOne blog | published — Bring Your Own Vulnerable Driver: How EDR Killing Became an Industry · The Good, the Bad and the Ugly in Cybersecurity - Week 41 (2026) (names the campaign in the title; the feed text carries no CVE id) |
| EDR / endpoint VM | SentinelOne Labs | published — Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties (names the campaign in the title; the feed text carries no CVE id) |
| WAF / edge | Akamai blog | nothing found — no post names it among the feed's 1179 newest items |
| WAF / edge | Cloudflare WAF managed-ruleset changelog | nothing found — no post names it among the feed's 136 newest items |
| Cloud / container | Wiz blog | nothing found — no post names it among the feed's 714 newest items |
| IDS / research | Cisco Talos blog | published — Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer · IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases · Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN (names the campaign in the title; the feed text carries no CVE id) |
| Detection content | Elastic detection rules | published — 34 files name Trojanized / Claude / Cursor: rules/macos/command_and_control_suspicious_curl_from_macos_application.toml, rules/macos/discovery_suspicious_sip_check.toml, rules/macos/discovery_full_disk_access_check.toml, rules/macos/persistence_ssfilecopyreceiver_file_writes.toml |
| Detection content | Elastic Security Labs | published — Auditing the auditor: Unmasking Apex Accelerator · No MDM for Linux? A 68-line Elastic workflow keeps every endpoint's config current (names the campaign in the title; the feed text carries no CVE id) |
| Detection content | SigmaHQ rules | published — 15 files name Trojanized / Claude / Cursor: rules-emerging-threats/2023/TA/Lazarus/README.md, rules/windows/process_creation/proc_creation_win_lolbin_gather_network_info.yml, rules-emerging-threats/2023/TA/Lazarus/image_load_apt_lazarus_side_load_activity.yml, rules/windows/process_creation/proc_creation_win_susp_gather_network_info_execution.yml |
| Detection content | Splunk ESCU | published — 36 files name Trojanized / Claude / Cursor: stories/gomir.yml, stories/salat_stealer.yml, stories/meduza_stealer.yml, stories/starland_rat_campaign.yml |
| MSSP / IR firms | Arctic Wolf blog | nothing found — no post names it among the feed's 10 newest items |
| MSSP / IR firms | Huntress blog | published — Fighting AI Slop in Production Codebases: How Huntress Improved Fable 5.1’s API Recall (names the campaign in the title; the feed text carries no CVE id) |
| MSSP / IR firms | Rapid7 blog | nothing found — no post names it among the feed's 20 newest items |
| MSSP / IR firms | Sophos threat research | published — Malicious Claude Code extension distributed through Cursor marketplace (names the campaign in the title; the feed text carries no CVE id) |
| Research | Unit 42 | nothing found — no post names it among the feed's 15 newest items |
Checked automatically 2026-10-31 13:48Z from public sources: 11 published, 7 nothing found, 1 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.
What a person would still look up (5)
| EDR / endpoint | Ask whether the product alerts on authorized_keys writes and on persistence created by IDE or extension-host processes, and whether it flags the C2 IP. |
| Proxy / firewall | Check whether 134.209.82.225 is on blocklists and whether plain-HTTP traffic to port 8099 is logged with URI path. |
| SIEM / detection content | Look for vendor or community content on this campaign, and on IDE extension-host processes writing SSH keys or scheduling tasks. |
| Asset / software inventory | Confirm the inventory can report IDE extension IDs, versions and install times per host. |
| Vulnerability / exposure management | Confirm whether the tool tracks IDE extensions at all; most CVE-keyed tooling will not, as there is no CVE. |
Exposure queries — generated automatically
shodan · alias · card
http.html:"Cursor Marketplace"
open · Banner spelling suggested by the model from the card text (distribution channel named in the card; appears on marketplace pages); counted against Shodan before it was shown.
10services internet-wide on Shodan · 2026-10-31▲ 4 on 2026-10-30 (+6 +150%)
Internet-wide count, trend
| Query | First | Latest | Change |
|---|---|---|---|
http.html:"Cursor Marketplace" | 4 2026-10-30 | 10 2026-10-31 | +6 (+150%) over 2 days |
Shodan's count of matching services on the whole internet, one point a day; the scope (your ranges) is never part of it. A count moves with Shodan's crawl as much as with patching, so read the direction, not the digit.
No CVE in this campaign: nothing an internet scanner keys on. Scope by product in your own tool.
Banner spellings: a model read 2 from the NVD names and this card's text (former and marketing names, console titles); 1 matched something on Shodan and is shown above, the rest was dropped.
Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-10-31 13:48Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.
Open questions
- Does the GitHub release page [S2] actually describe the malicious build and 2.1.314 as the fix? The pipeline attributes artifact quotes to S2, but they read like the [S1] article text.
- Has Cursor or Anthropic issued a formal advisory?
- Which material development triggered this revision? Today's story repeats the facts already in version 2.
Sources
- [S1] https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html · The Hacker News
- [S2] https://github.com/anthropics/claude-code/releases · GitHub
Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically once it crosses the publish bar.