Cutsign — draft: Trojanized Claude Code extension 2.1.313 on Cursor Marketplace adds SSH key, persistence and beacon

AI-generated draft, unreviewed. Version 2, written by a model from the stored public sources on 2026-10-30; hype score 6. It is regenerated when the evidence changes and is published as a verdict card under /cards/ once it crosses the publish bar. Status: superseded. Supersedes version 1.

Trojanized Claude Code extension 2.1.313 on Cursor Marketplace adds SSH key, persistence and beacon

Hunt / IR + PatchP1confidence: mediumP1 +2deep read +1primary source +1material development on watch +2P1: card on day one (score below the publish bar; revised as the story develops)

A malicious Claude Code extension build (2.1.313) was distributed through the Cursor Marketplace for about 11 hours on Oct 29, 2026, reaching at most 5,000 users. Today, find any developer host that received it, then hunt for the 'svc-telemetry' SSH key, IDE-spawned persistence and traffic to 134.209.82.225.

Triage: The backdoor reached developer workstations through an auto-updating marketplace, and the reporting gives concrete artifacts to hunt today. [S1]

The core technical claims come from reputable secondary reporting [S1]. The inputs quote no Anthropic or Cursor advisory text directly, and the release page [S2] has not been confirmed to describe the incident.

Changed since version 1

Added reach of at most 5,000 users to what_happened, verdict and scope. [S1]
Added that no follow-on payloads have been observed; applied to the credential-rotation note and as a re-entry trigger. [S1]
Added the loader detail: a 66-line JavaScript loader. [S1]
Added the eradicate, reenter_when, coverage_checks and open_questions sections, which were missing from the prior draft, and an open question on the S2 attribution in the behaviors block.
Added a debrief gap on the basis of the 5,000-user figure.

What happened

Version 2.1.313 of anthropic.claude-code was served by the Cursor Marketplace from about 2:27 a.m. to 1:35 p.m. PT on Oct 29, 2026, reaching at most 5,000 users. [S1]
A 66-line JavaScript loader adds an attacker SSH key labelled 'svc-telemetry' to ~/.ssh/authorized_keys, tries to enable SSH and opens a reverse tunnel to 134.209.82.225. [S1]
It installs persistence as a scheduled task, crontab entry or LaunchAgent, depending on the platform. [S1]
It sends host reconnaissance, including the global Git email, over unencrypted HTTP to 134.209.82.225:8099/beacon. [S1]
Enabling SSH fails without admin rights on most macOS and Windows hosts. The key, persistence and beacon are still created. No follow-on payloads have been observed. [S1]

Timeline

2026-10-29 ~02:27 PT	Malicious 2.1.313 becomes available on the Cursor Marketplace S1
2026-10-29 ~13:35 PT	End of the distribution window S1
2026-10-30	Public reporting: reach of at most 5,000 users; no follow-on payloads observed S1

Detect

svc-telemetry key in authorized_keys · FIM / EDR file events on ~/.ssh/authorized_keys

index=* (file_path="*/.ssh/authorized_keys" OR TargetFilename="*authorized_keys") "svc-telemetry" | stats count min(_time) as first max(_time) as last by host, user, file_path, process_name

A hit means: The attacker key was planted on this host. Treat the host as compromised and check whether SSH is enabled.

Traffic to C2 134.209.82.225 · Firewall / proxy / EDR network events

index=* (dest_ip="134.209.82.225" OR dest="134.209.82.225" OR url="*134.209.82.225*") | stats count min(_time) as first max(_time) as last by src_ip, user, dest_port, process_name, url

A hit means: Port 8099 means the beacon sent host recon. Other ports, especially an SSH session, suggest the reverse tunnel was established.

Persistence created by the IDE · EDR process/file events, Windows 4698, macOS LaunchAgents FIM

index=* earliest="10/29/2026:00:00:00" (parent_process_name="*Cursor*" OR process_name="*Cursor*") (process_name IN ("schtasks.exe","crontab","launchctl") OR EventCode=4698 OR file_path="*/Library/LaunchAgents/*") | stats count by host, user, process_name, command_line, file_path

A hit means: The Cursor process tree created a scheduled task, cron entry or LaunchAgent. This likely matches the loader's persistence.

Beacon pattern and IP lookup from IDE · Proxy

index=* ((dest_port=8099 uri_path="/beacon") OR (url="*api.ipify.org*" (process_name="*Cursor*" OR process_name="*node*"))) | stats count by src_ip, user, url, process_name

A hit means: This matches the beacon behaviour and should catch it if the C2 IP changes. An ipify request alone is weaker and needs corroboration.

Verify

Confirm the extension version on the host is 2.1.313 and that it was installed from the Cursor Marketplace inside the Oct 29 window. [S1]
A true positive should show the 'svc-telemetry' key together with an IDE-spawned persistence entry or traffic to 134.209.82.225. [S1]
Benign look-alikes: legitimate tools calling api.ipify.org, admins adding SSH keys, and extensions creating scheduled tasks for updates. None of these should carry the 'svc-telemetry' label or point at the C2 IP.
A running `git config --global user.email` is common in IDEs. Only count it when it sits in the same 2.1.313 extension-host process tree.

Scope

Affected

anthropic.claude-code 2.1.313 installed via the Cursor Marketplace, about 2:27 a.m.–1:35 p.m. PT Oct 29, 2026; at most 5,000 users [S1]

Only if

Installed or auto-updated in Cursor IDE from the Cursor Marketplace during the window [S1]
Attacker SSH login through the tunnel requires the local SSH service to be enabled, which needs admin rights on most macOS/Windows hosts [S1]

Not affected if

Extension is not at version 2.1.313 [S1]
Extension was installed from Open VSX or the Microsoft VS Code Marketplace (per pipeline exposure data; confirm in [S1])

Fixed in: 2.1.314 (pipeline exposure data; confirm against [S2])

Enumerate

Hosts with Cursor IDE installed and their extension versions and install times
Developer users whose global Git email may have been sent in the beacon
Hosts where SSH/sshd was enabled or running on Oct 29 or later
Users with local admin rights among affected hosts
Secrets reachable from affected user profiles: SSH keys, cloud tokens, repo credentials

Contain

Block 134.209.82.225 at egress and alert on any further attempts. [S1]
Before removing anything, preserve copies of authorized_keys, the persistence entries, the extension folder and network logs.
Isolate hosts showing the key plus a tunnel or SSH connection.
Remove or update the 2.1.313 extension. Pause extension auto-update in Cursor until the publisher's status is confirmed.
As a precaution, rotate credentials reachable from hosts where SSH was enabled and the tunnel was seen. This cannot be undone, and the sources report no credential theft or follow-on payloads. [S1]

Eradicate

Remove the 'svc-telemetry' line from ~/.ssh/authorized_keys. [S1]
Delete the loader's scheduled task, crontab entry or LaunchAgent. [S1]
Uninstall 2.1.313 and reinstall a known-good version from a verified source. [S1]
Disable SSH where it was enabled during or after the window and is not needed. [S1]

Recover

Before returning a host, confirm a clean extension version, no 'svc-telemetry' key and no IDE-created persistence.
Afterwards, monitor for traffic to 134.209.82.225, port 8099 /beacon, and new authorized_keys writes from IDE processes.

Re-enter the loop when

Follow-on payloads or tunnel use are reported, which would reverse the current 'none observed' finding. [S1]
New C2 IPs, key labels or loader hashes are published.
Anthropic or Cursor publish an advisory that changes the window, the affected versions, the fixed version or the marketplaces involved.
Another extension or marketplace (Open VSX, VS Code Marketplace) is reported as affected.
Internal hunts find SSH sessions through the tunnel, or hits outside the Oct 29 window.

Debrief

Record affected hosts, install times, the source marketplace and whether SSH was enabled on each.
Record whether extension auto-update and marketplace sourcing are controlled for developer IDEs.
Gap: no official advisory from Anthropic or Cursor is quoted directly in the inputs.
Gap: how the build entered the Cursor Marketplace (publisher account compromise or marketplace issue) is not stated.
Gap: the basis for the 'at most 5,000 users' figure is not given.

Detection coverage — checked automatically

Category	Source	Status
Vendor	Impacted vendor / CERT advisory	published — primary source among the thread's sources: https://github.com/anthropics/claude-code/releases
Government	CISA KEV	not checkable — no CVE: the catalog is keyed by CVE
EDR / endpoint VM	CrowdStrike blog	nothing found — no post names it among the feed's 10 newest items
EDR / endpoint VM	Microsoft Security blog	published — Tracking AI adoption in North Korean threat actor tradecraft · Agents are your newest insiders. Security must move at their speed. · The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime (names the campaign in the title; the feed text carries no CVE id)
EDR / endpoint VM	SentinelOne blog	published — Bring Your Own Vulnerable Driver: How EDR Killing Became an Industry · The Good, the Bad and the Ugly in Cybersecurity - Week 41 (2026) (names the campaign in the title; the feed text carries no CVE id)
EDR / endpoint VM	SentinelOne Labs	published — Don’t Call Us, We’ll Call Your APIs \| TraderTraitor Backdoors Resurface on Victim With No Crypto Ties (names the campaign in the title; the feed text carries no CVE id)
WAF / edge	Akamai blog	nothing found — no post names it among the feed's 1178 newest items
WAF / edge	Cloudflare WAF managed-ruleset changelog	nothing found — no post names it among the feed's 133 newest items
Cloud / container	Wiz blog	nothing found — no post names it among the feed's 713 newest items
IDS / research	Cisco Talos blog	published — IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases · Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN (names the campaign in the title; the feed text carries no CVE id)
Detection content	Elastic detection rules	published — 34 files name Trojanized / Claude / Cursor: rules/macos/command_and_control_suspicious_curl_from_macos_application.toml, rules/macos/discovery_suspicious_sip_check.toml, rules/macos/discovery_full_disk_access_check.toml, rules/macos/persistence_ssfilecopyreceiver_file_writes.toml
Detection content	Elastic Security Labs	published — Auditing the auditor: Unmasking Apex Accelerator · No MDM for Linux? A 68-line Elastic workflow keeps every endpoint's config current (names the campaign in the title; the feed text carries no CVE id)
Detection content	SigmaHQ rules	published — 15 files name Trojanized / Claude / Cursor: rules-emerging-threats/2023/TA/Lazarus/README.md, rules/windows/process_creation/proc_creation_win_lolbin_gather_network_info.yml, rules-emerging-threats/2023/TA/Lazarus/image_load_apt_lazarus_side_load_activity.yml, rules/windows/process_creation/proc_creation_win_susp_gather_network_info_execution.yml
Detection content	Splunk ESCU	published — 36 files name Trojanized / Claude / Cursor: stories/gomir.yml, stories/salat_stealer.yml, stories/meduza_stealer.yml, stories/starland_rat_campaign.yml
MSSP / IR firms	Arctic Wolf blog	nothing found — no post names it among the feed's 10 newest items
MSSP / IR firms	Huntress blog	published — Fighting AI Slop in Production Codebases: How Huntress Improved Fable 5.1’s API Recall (names the campaign in the title; the feed text carries no CVE id)
MSSP / IR firms	Rapid7 blog	nothing found — no post names it among the feed's 20 newest items
MSSP / IR firms	Sophos threat research	published — Malicious Claude Code extension distributed through Cursor marketplace (names the campaign in the title; the feed text carries no CVE id)
Research	Unit 42	nothing found — no post names it among the feed's 15 newest items

Checked automatically 2026-10-30 18:12Z from public sources: 11 published, 7 nothing found, 1 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

What a person would still look up (5)

EDR / endpoint	Whether the product alerts on IDE or extension-host processes writing authorized_keys or creating scheduled tasks, crontab entries or LaunchAgents.
Network / proxy / firewall	Whether the C2 IP 134.209.82.225 is blocked or alerted on, and whether HTTP to port 8099 /beacon is logged.
FIM	Whether ~/.ssh/authorized_keys and ~/Library/LaunchAgents are monitored on developer endpoints.
Software inventory / MDM	Whether IDE extension IDs, versions and install sources can be inventoried across endpoints.
Detection content (Sigma/ESCU/Elastic)	Whether any published rule specifically references this extension or its IoCs. The keyword matches listed in the prior coverage appear generic and need manual review.

Exposure queries — generated automatically

shodan · alias · card

http.html:"Cursor Marketplace"

open · Banner spelling suggested by the model from the card text (distribution channel named in the card; appears on marketplace pages); counted against Shodan before it was shown.

4services internet-wide on Shodan · 2026-10-30

No CVE in this campaign: nothing an internet scanner keys on. Scope by product in your own tool.

Banner spellings: a model read 2 from the NVD names and this card's text (former and marketing names, console titles); 1 matched something on Shodan and is shown above, the rest was dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-10-30 18:12Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

The behaviors block attributes quotes to S2 (the GitHub releases page), but the text reads like the S1 article. Confirm whether Anthropic has published incident details or a 2.1.314 note.
Is 2.1.314 the confirmed clean version, and was 2.1.313 published by Anthropic's own account?
Are Open VSX and the VS Code Marketplace confirmed unaffected by a primary source?
How was the 5,000-user ceiling derived?
Did any SSH session through the reverse tunnel succeed on any victim?

Sources

[S1] https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html · The Hacker News
[S2] https://github.com/anthropics/claude-code/releases · GitHub

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically once it crosses the publish bar.