/cards/ once it crosses the publish bar. Status: superseded. Supersedes version 3.Trojanized Claude Code extension 2.1.313 on Cursor Marketplace adds SSH key, persistence and beacon
A malicious Claude Code extension build (2.1.313) was distributed through the Cursor Marketplace for about 11 hours on Oct 29, 2026, reaching at most 5,000 users. Today, find any developer host that received it, then hunt for the 'svc-telemetry' SSH key, IDE-spawned persistence and traffic to 134.209.82.225.
Triage: The backdoor reached developer workstations through an auto-updating marketplace, and the reporting gives concrete artifacts to hunt today. [S1]
The core claims come from reputable secondary reporting [S1]. The pipeline attributes the artifact quotes to the vendor release page [S2], but no vendor text is shown directly in the inputs. Microsoft and Sophos posts appear in pipeline coverage data, but they are not among the card's sources and have not been reviewed.
Changed since version 3
- Added an open question and a re-entry trigger for the Microsoft Security blog and Sophos posts that appear in pipeline coverage data. These are not yet sources, so the card's facts are unchanged ([S1] still the basis).
- Confidence reason now notes the unreviewed Microsoft and Sophos posts.
What happened
- Version 2.1.313 of the Claude Code extension (anthropic.claude-code) was distributed via the Cursor Marketplace from about 2:27 a.m. to 1:35 p.m. PT on Oct 29, 2026, reaching at most 5,000 users. [S1]
- A 66-line JS loader adds an attacker SSH key labelled 'svc-telemetry' to ~/.ssh/authorized_keys and tries to enable SSH. [S1]
- It opens a reverse tunnel to 134.209.82[.]225 and installs persistence as a scheduled task, crontab entry or LaunchAgent. [S1]
- It beacons host recon, including the global Git email, over unencrypted HTTP to 134.209.82[.]225:8099/beacon. [S1]
- Enabling SSH fails without admin rights on most macOS/Windows hosts. The key, persistence and beacon still occur. No follow-on payloads were observed. [S1]
Timeline
| 2026-10-29 ~02:27 PT | Malicious 2.1.313 becomes available on the Cursor Marketplace S1 |
| 2026-10-29 ~13:35 PT | Distribution window ends S1 |
| 2026-10-30 | Public reporting of the trojanized extension and its IoCs S1 |
Detect
svc-telemetry key in authorized_keys · FIM / EDR file events on ~/.ssh/authorized_keys
index=* (file_path="*/.ssh/authorized_keys" OR TargetFilename="*authorized_keys") "svc-telemetry" | stats count min(_time) as first max(_time) as last by host, user, file_path, process_name
A hit means: The attacker key was planted on this host. Treat the host as compromised and check whether SSH is enabled.
Traffic to C2 134.209.82.225 · Firewall / proxy / EDR network events
index=* (dest_ip="134.209.82.225" OR dest="134.209.82.225" OR url="*134.209.82.225*") | stats count min(_time) as first max(_time) as last by src_ip, user, dest_port, process_name, url
A hit means: Port 8099 means the beacon sent host recon. Other ports, especially an SSH session, suggest the reverse tunnel was established.
Persistence created by the IDE · EDR process/file events, Windows 4698, macOS LaunchAgents FIM
index=* earliest="10/29/2026:00:00:00" (parent_process_name="*Cursor*" OR process_name="*Cursor*") (process_name IN ("schtasks.exe","crontab","launchctl") OR EventCode=4698 OR file_path="*/Library/LaunchAgents/*") | stats count by host, user, process_name, command_line, file_pathA hit means: The Cursor process tree created a scheduled task, cron entry or LaunchAgent. This likely matches the loader's persistence.
Beacon pattern and IP lookup from IDE · Proxy
index=* ((dest_port=8099 uri_path="/beacon") OR (url="*api.ipify.org*" (process_name="*Cursor*" OR process_name="*node*"))) | stats count by src_ip, user, url, process_name
A hit means: This matches the beacon behaviour and should catch it if the C2 IP changes. An ipify request alone is weaker and needs corroboration.
Verify
- Confirm the extension version on the host is 2.1.313 and that it was installed from the Cursor Marketplace inside the Oct 29 window. [S1]
- A true positive should show the 'svc-telemetry' key together with an IDE-spawned persistence entry or traffic to 134.209.82.225. [S1]
- Benign look-alikes: legitimate tools calling api.ipify.org, admins adding SSH keys, and extensions creating scheduled tasks for updates. None of these should carry the 'svc-telemetry' label or point at the C2 IP.
- A running `git config --global user.email` is common in IDEs. Only count it when it sits in the same 2.1.313 extension-host process tree.
Scope
Affected
- anthropic.claude-code 2.1.313 installed via the Cursor Marketplace, about 2:27 a.m.–1:35 p.m. PT Oct 29, 2026; at most 5,000 users [S1]
Only if
- Installed or auto-updated in Cursor IDE from the Cursor Marketplace during the window [S1]
- Attacker SSH login through the tunnel requires the local SSH service to be enabled, which needs admin rights on most macOS/Windows hosts [S1]
Not affected if
- Extension is not at version 2.1.313 [S1]
- Extension was installed from Open VSX or the Microsoft VS Code Marketplace (per pipeline exposure data; confirm in [S1])
Fixed in: 2.1.314 (pipeline exposure data; confirm against [S2])
Enumerate
- Hosts with Cursor IDE installed, with their extension versions and install times
- Developer users whose global Git email may have been sent in the beacon
- Hosts where SSH/sshd was enabled or running on Oct 29 or later
- Users with local admin rights among affected hosts
- Secrets reachable from affected user profiles: SSH keys, cloud tokens, repo credentials
Contain
- Block 134.209.82.225 at egress and alert on any further attempts. [S1]
- Before removing anything, preserve copies of authorized_keys, the persistence entries, the extension folder and network logs.
- Isolate hosts showing the key plus a tunnel or SSH connection.
- Remove or update the 2.1.313 extension. Pause extension auto-update in Cursor until the publisher's status is confirmed.
- As a precaution, rotate credentials reachable from hosts where SSH was enabled and the tunnel was seen. This cannot be undone, and the sources report no credential theft or follow-on payloads. [S1]
Eradicate
- Remove the 'svc-telemetry' key from ~/.ssh/authorized_keys. [S1]
- Delete the loader-created scheduled task, crontab entry or LaunchAgent. [S1]
- Uninstall 2.1.313 and its extension folder, then install a confirmed clean version.
- Disable SSH where it was enabled by the loader rather than by policy. [S1]
Recover
- Before returning a host, confirm a clean extension version, no 'svc-telemetry' key and no IDE-created persistence.
- Afterwards, monitor for traffic to 134.209.82.225, port 8099 /beacon, and new authorized_keys writes from IDE processes.
Re-enter the loop when
- A new C2 address, key label or extension version is reported
- Follow-on payloads or credential theft are reported, contradicting 'none observed' [S1]
- Anthropic or Cursor changes the affected window, version or install count
- Other marketplaces (Open VSX, VS Code Marketplace) are reported as affected
- The Microsoft or Sophos posts are reviewed and add IoCs or behaviours not in [S1]
Debrief
- Record affected hosts, install times, the source marketplace and whether SSH was enabled on each.
- Record whether extension auto-update and marketplace sourcing are controlled for developer IDEs.
- Gap: the pipeline attributes artifact quotes to the vendor release page [S2], but no Anthropic or Cursor text is shown directly in the inputs.
- Gap: how the build entered the Cursor Marketplace (publisher account compromise or marketplace issue) is not stated.
- Gap: the basis for the 'at most 5,000 users' figure is not given.
Detection coverage — checked automatically
| Category | Source | Status |
|---|---|---|
| Vendor | Impacted vendor / CERT advisory | published — primary source among the thread's sources: https://github.com/anthropics/claude-code/releases |
| Government | CISA KEV | not checkable — no CVE: the catalog is keyed by CVE |
| EDR / endpoint VM | CrowdStrike blog | nothing found — no post names it among the feed's 10 newest items |
| EDR / endpoint VM | Microsoft Security blog | published — Inside a malicious Claude Code-branded extension and its persistent SSH backdoor · Tracking AI adoption in North Korean threat actor tradecraft · Agents are your newest insiders. Security must move at their speed. (names the campaign in the title; the feed text carries no CVE id) |
| EDR / endpoint VM | SentinelOne blog | published — Bring Your Own Vulnerable Driver: How EDR Killing Became an Industry · The Good, the Bad and the Ugly in Cybersecurity - Week 41 (2026) (names the campaign in the title; the feed text carries no CVE id) |
| EDR / endpoint VM | SentinelOne Labs | published — Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties (names the campaign in the title; the feed text carries no CVE id) |
| WAF / edge | Akamai blog | nothing found — no post names it among the feed's 1179 newest items |
| WAF / edge | Cloudflare WAF managed-ruleset changelog | nothing found — no post names it among the feed's 136 newest items |
| Cloud / container | Wiz blog | nothing found — no post names it among the feed's 714 newest items |
| IDS / research | Cisco Talos blog | published — Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer · IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases · Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN (names the campaign in the title; the feed text carries no CVE id) |
| Detection content | Elastic detection rules | published — 34 files name Trojanized / Claude / Cursor: rules/macos/command_and_control_suspicious_curl_from_macos_application.toml, rules/macos/discovery_suspicious_sip_check.toml, rules/macos/discovery_full_disk_access_check.toml, rules/macos/persistence_ssfilecopyreceiver_file_writes.toml |
| Detection content | Elastic Security Labs | published — Auditing the auditor: Unmasking Apex Accelerator · No MDM for Linux? A 68-line Elastic workflow keeps every endpoint's config current (names the campaign in the title; the feed text carries no CVE id) |
| Detection content | SigmaHQ rules | published — 15 files name Trojanized / Claude / Cursor: rules-emerging-threats/2023/TA/Lazarus/README.md, rules/windows/process_creation/proc_creation_win_lolbin_gather_network_info.yml, rules-emerging-threats/2023/TA/Lazarus/image_load_apt_lazarus_side_load_activity.yml, rules/windows/process_creation/proc_creation_win_susp_gather_network_info_execution.yml |
| Detection content | Splunk ESCU | published — 36 files name Trojanized / Claude / Cursor: stories/gomir.yml, stories/salat_stealer.yml, stories/meduza_stealer.yml, stories/starland_rat_campaign.yml |
| MSSP / IR firms | Arctic Wolf blog | nothing found — no post names it among the feed's 10 newest items |
| MSSP / IR firms | Huntress blog | published — Fighting AI Slop in Production Codebases: How Huntress Improved Fable 5.1’s API Recall (names the campaign in the title; the feed text carries no CVE id) |
| MSSP / IR firms | Rapid7 blog | nothing found — no post names it among the feed's 20 newest items |
| MSSP / IR firms | Sophos threat research | published — Malicious Claude Code extension distributed through Cursor marketplace (names the campaign in the title; the feed text carries no CVE id) |
| Research | Unit 42 | nothing found — no post names it among the feed's 15 newest items |
Checked automatically 2026-10-31 19:02Z from public sources: 11 published, 7 nothing found, 1 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.
What a person would still look up (4)
| EDR / endpoint | Check whether the vendor flags writes to authorized_keys by IDE extension hosts, and persistence created by Cursor child processes. |
| Network / proxy / firewall | Check whether 134.209.82.225 and the :8099/beacon URL are in threat feeds and blocklists. |
| Detection content (Sigma / Splunk ESCU / Elastic) | Search for rules specific to this extension campaign. The keyword hits in pipeline data look generic and are not confirmed to cover it. |
| Software inventory / MDM | Check whether IDE extension versions and their install sources are inventoried for developer hosts. |
Exposure queries — generated automatically
shodan · alias · card
http.html:"Cursor Marketplace"
open · Banner spelling suggested by the model from the card text (distribution channel named in the card; appears on marketplace pages); counted against Shodan before it was shown.
11services internet-wide on Shodan · 2026-10-31▲ 4 on 2026-10-30 (+7 +175%)
Internet-wide count, trend
| Query | First | Latest | Change |
|---|---|---|---|
http.html:"Cursor Marketplace" | 4 2026-10-30 | 11 2026-10-31 | +7 (+175%) over 2 days |
Shodan's count of matching services on the whole internet, one point a day; the scope (your ranges) is never part of it. A count moves with Shodan's crawl as much as with patching, so read the direction, not the digit.
No CVE in this campaign: nothing an internet scanner keys on. Scope by product in your own tool.
Banner spellings: a model read 2 from the NVD names and this card's text (former and marketing names, console titles); 1 matched something on Shodan and is shown above, the rest was dropped.
Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-10-31 19:02Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.
Open questions
- Pipeline coverage data lists a Microsoft Security blog post ('Inside a malicious Claude Code-branded extension and its persistent SSH backdoor') and a Sophos post on this campaign. Neither is in the card's sources. An analyst should review both for new IoCs and add them as sources.
- Is 2.1.314 confirmed clean by Anthropic or Cursor [S2]?
- Was the Cursor Marketplace publisher account compromised, or was this a marketplace-side issue?
- Do the Open VSX / VS Code Marketplace exclusions come from a primary source?
Sources
- [S1] https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html · The Hacker News
- [S2] https://github.com/anthropics/claude-code/releases · GitHub
Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically once it crosses the publish bar.