/cards/ once it crosses the publish bar. Status: superseded. Supersedes version 4.Trojanized Claude Code extension 2.1.313 on Cursor Marketplace adds SSH key, persistence and beacon
A malicious build (2.1.313) of the Claude Code extension was distributed through the Cursor Marketplace for about 11 hours on Oct 29, 2026, reaching at most 5,000 users [S1]. Today, find any developer host that received it, then hunt for the 'svc-telemetry' SSH key, IDE-spawned persistence and traffic to 134.209.82.225.
Triage: The backdoor reached developer workstations through an auto-updating marketplace, and the reporting gives concrete artifacts to hunt today. [S1]
The core claims come from reputable secondary reporting [S1]. The pipeline attributes the artifact quotes to the vendor release page [S2], but no Anthropic or Cursor text appears directly in the inputs.
Changed since version 4
- No card content changed. Today's story repeats [S1] and [S2] with no new facts.
- Added confidence (medium) and its reason, because [S1] is secondary and the [S2] text is not shown.
- Added eradicate steps and re-entry triggers drawn from [S1].
- Added an open question on the unidentified material development and the unsourced vendor posts from the coverage scan.
What happened
- Version 2.1.313 of anthropic.claude-code was served by the Cursor Marketplace from about 2:27 a.m. to 1:35 p.m. PT on Oct 29, 2026, reaching at most 5,000 users. [S1]
- A 66-line JS loader adds an attacker SSH key labelled 'svc-telemetry' to ~/.ssh/authorized_keys and tries to enable SSH. [S1]
- It opens a reverse tunnel to 134.209.82.225 and installs persistence as a scheduled task, crontab or LaunchAgent. [S1]
- It beacons host recon, including the global Git email, over unencrypted HTTP to 134.209.82.225:8099/beacon. [S1]
- Enabling SSH fails without admin rights on most macOS/Windows hosts, but the key, persistence and beacon still occur. No follow-on payloads were observed. [S1]
Timeline
| 2026-10-29 | Malicious 2.1.313 available on the Cursor Marketplace, about 2:27 a.m.–1:35 p.m. PT S1 |
| 2026-10-30 | Public reporting of the trojanized build and its artifacts S1 |
Detect
svc-telemetry key in authorized_keys · FIM / EDR file events on ~/.ssh/authorized_keys
index=* (file_path="*/.ssh/authorized_keys" OR TargetFilename="*authorized_keys") "svc-telemetry" | stats count min(_time) as first max(_time) as last by host, user, file_path, process_name
A hit means: The attacker key was planted on this host. Treat the host as compromised and check whether SSH is enabled.
Traffic to C2 134.209.82.225 · Firewall / proxy / EDR network events
index=* (dest_ip="134.209.82.225" OR dest="134.209.82.225" OR url="*134.209.82.225*") | stats count min(_time) as first max(_time) as last by src_ip, user, dest_port, process_name, url
A hit means: Port 8099 means the beacon sent host recon. Other ports, especially an SSH session, suggest the reverse tunnel was established.
Persistence created by the IDE · EDR process/file events, Windows 4698, macOS LaunchAgents FIM
index=* earliest="10/29/2026:00:00:00" (parent_process_name="*Cursor*" OR process_name="*Cursor*") (process_name IN ("schtasks.exe","crontab","launchctl") OR EventCode=4698 OR file_path="*/Library/LaunchAgents/*") | stats count by host, user, process_name, command_line, file_pathA hit means: The Cursor process tree created a scheduled task, cron entry or LaunchAgent. This likely matches the loader's persistence.
Beacon pattern and IP lookup from IDE · Proxy
index=* ((dest_port=8099 uri_path="/beacon") OR (url="*api.ipify.org*" (process_name="*Cursor*" OR process_name="*node*"))) | stats count by src_ip, user, url, process_name
A hit means: This matches the beacon behaviour and should catch it if the C2 IP changes. An ipify request alone is weaker and needs corroboration.
Verify
- Confirm the extension version on the host is 2.1.313 and that it was installed from the Cursor Marketplace inside the Oct 29 window. [S1]
- A true positive should show the 'svc-telemetry' key together with an IDE-spawned persistence entry or traffic to 134.209.82.225. [S1]
- Benign look-alikes include legitimate tools calling api.ipify.org, admins adding SSH keys, and extensions creating scheduled tasks for updates. None of these should carry the 'svc-telemetry' label or point at the C2 IP.
- IDEs commonly run `git config --global user.email`. Only count it when it sits in the same 2.1.313 extension-host process tree.
Scope
Affected
- anthropic.claude-code 2.1.313 installed via the Cursor Marketplace, about 2:27 a.m.–1:35 p.m. PT Oct 29, 2026; at most 5,000 users [S1]
Only if
- Installed or auto-updated in Cursor IDE from the Cursor Marketplace during the window [S1]
- Attacker SSH login through the tunnel requires the local SSH service to be enabled, which needs admin rights on most macOS/Windows hosts [S1]
Not affected if
- Extension is not at version 2.1.313 [S1]
- Extension was installed from Open VSX or the Microsoft VS Code Marketplace (per pipeline exposure data; confirm in [S1])
Fixed in: 2.1.314 (pipeline exposure data; confirm against [S2])
Enumerate
- Hosts with Cursor IDE installed, with their extension versions and install times
- Developer users whose global Git email may have been sent in the beacon
- Hosts where SSH/sshd was enabled or running on Oct 29 or later
- Users with local admin rights among affected hosts
- Secrets reachable from affected user profiles: SSH keys, cloud tokens, repo credentials
Contain
- Block 134.209.82.225 at egress and alert on any further attempts. [S1]
- Before removing anything, preserve copies of authorized_keys, the persistence entries, the extension folder and network logs.
- Isolate hosts that show the key plus a tunnel or SSH connection.
- Remove or update the 2.1.313 extension. Pause extension auto-update in Cursor until the publisher's status is confirmed.
- As a precaution, rotate credentials reachable from hosts where SSH was enabled and the tunnel was seen. Rotation cannot be undone. The sources report no credential theft or follow-on payloads. [S1]
Eradicate
- Remove the 'svc-telemetry' line from ~/.ssh/authorized_keys. [S1]
- Delete the scheduled task, crontab entry or LaunchAgent the loader created. [S1]
- Remove extension 2.1.313 and its folder, then install a clean version from a confirmed source.
- Where the loader enabled SSH, disable it unless there is a business need. [S1]
Recover
- Before returning a host, confirm a clean extension version, no 'svc-telemetry' key and no IDE-created persistence.
- Afterwards, monitor for traffic to 134.209.82.225, port 8099 /beacon, and new authorized_keys writes from IDE processes.
Re-enter the loop when
- Anthropic or Cursor publishes an advisory that changes the version range, the window or the user count.
- New C2 addresses, key labels or follow-on payloads are reported.
- The same build is reported on Open VSX or the Microsoft VS Code Marketplace.
- Any host shows an inbound SSH session through the tunnel, or credential use from an affected user.
Debrief
- Record affected hosts, install times, the source marketplace and whether SSH was enabled on each.
- Record whether extension auto-update and marketplace sourcing are controlled for developer IDEs.
- Gap: the pipeline attributes artifact quotes to the vendor release page [S2], but no Anthropic or Cursor text is shown directly in the inputs.
- Gap: how the build entered the Cursor Marketplace (publisher account compromise or a marketplace issue) is not stated.
- Gap: the basis for the 'at most 5,000 users' figure is not given.
Detection coverage — checked automatically
| Category | Source | Status |
|---|---|---|
| Vendor | Impacted vendor / CERT advisory | published — primary source among the thread's sources: https://github.com/anthropics/claude-code/releases |
| Government | CISA KEV | not checkable — no CVE: the catalog is keyed by CVE |
| EDR / endpoint VM | CrowdStrike blog | nothing found — no post names it among the feed's 10 newest items |
| EDR / endpoint VM | Microsoft Security blog | published — Inside a malicious Claude Code-branded extension and its persistent SSH backdoor · Tracking AI adoption in North Korean threat actor tradecraft · Agents are your newest insiders. Security must move at their speed. (names the campaign in the title; the feed text carries no CVE id) |
| EDR / endpoint VM | SentinelOne blog | published — Bring Your Own Vulnerable Driver: How EDR Killing Became an Industry · The Good, the Bad and the Ugly in Cybersecurity - Week 41 (2026) (names the campaign in the title; the feed text carries no CVE id) |
| EDR / endpoint VM | SentinelOne Labs | published — Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties (names the campaign in the title; the feed text carries no CVE id) |
| WAF / edge | Akamai blog | nothing found — no post names it among the feed's 1179 newest items |
| WAF / edge | Cloudflare WAF managed-ruleset changelog | nothing found — no post names it among the feed's 136 newest items |
| Cloud / container | Wiz blog | nothing found — no post names it among the feed's 714 newest items |
| IDS / research | Cisco Talos blog | published — Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer · IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases · Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN (names the campaign in the title; the feed text carries no CVE id) |
| Detection content | Elastic detection rules | published — 34 files name Trojanized / Claude / Cursor: rules/macos/command_and_control_suspicious_curl_from_macos_application.toml, rules/macos/discovery_suspicious_sip_check.toml, rules/macos/discovery_full_disk_access_check.toml, rules/macos/persistence_ssfilecopyreceiver_file_writes.toml |
| Detection content | Elastic Security Labs | published — Auditing the auditor: Unmasking Apex Accelerator · No MDM for Linux? A 68-line Elastic workflow keeps every endpoint's config current (names the campaign in the title; the feed text carries no CVE id) |
| Detection content | SigmaHQ rules | published — 15 files name Trojanized / Claude / Cursor: rules-emerging-threats/2023/TA/Lazarus/README.md, rules/windows/process_creation/proc_creation_win_lolbin_gather_network_info.yml, rules-emerging-threats/2023/TA/Lazarus/image_load_apt_lazarus_side_load_activity.yml, rules/windows/process_creation/proc_creation_win_susp_gather_network_info_execution.yml |
| Detection content | Splunk ESCU | published — 36 files name Trojanized / Claude / Cursor: stories/gomir.yml, stories/salat_stealer.yml, stories/meduza_stealer.yml, stories/starland_rat_campaign.yml |
| MSSP / IR firms | Arctic Wolf blog | nothing found — no post names it among the feed's 10 newest items |
| MSSP / IR firms | Huntress blog | published — Fighting AI Slop in Production Codebases: How Huntress Improved Fable 5.1’s API Recall (names the campaign in the title; the feed text carries no CVE id) |
| MSSP / IR firms | Rapid7 blog | nothing found — no post names it among the feed's 20 newest items |
| MSSP / IR firms | Sophos threat research | published — Malicious Claude Code extension distributed through Cursor marketplace (names the campaign in the title; the feed text carries no CVE id) |
| Research | Unit 42 | nothing found — no post names it among the feed's 15 newest items |
Checked automatically 2026-11-01 07:07Z from public sources: 11 published, 7 nothing found, 1 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.
What a person would still look up (4)
| EDR / endpoint | Ask the vendor whether it has detection or hunting content for IDE-spawned authorized_keys writes and persistence tied to this campaign. |
| Network / proxy | Check whether 134.209.82.225 and the :8099/beacon URL are in current threat feeds and blocklists. |
| Detection content (Sigma / Splunk / Elastic) | Look for published rules covering authorized_keys modification by editor processes and IDE-spawned scheduled tasks or LaunchAgents. |
| Software inventory / MDM | Confirm you can list IDE extensions and versions per host, including Cursor. |
Exposure queries — generated automatically
shodan · alias · card
http.html:"Cursor Marketplace"
open · Banner spelling suggested by the model from the card text (distribution channel named in the card; appears on marketplace pages); counted against Shodan before it was shown.
11services internet-wide on Shodan · 2026-11-01▲ 4 on 2026-10-30 (+7 +175%) · 11 on 2026-10-31 (+0 +0%)
Internet-wide count, trend
| Query | First | Latest | Change |
|---|---|---|---|
http.html:"Cursor Marketplace" | 4 2026-10-30 | 11 2026-11-01 | +7 (+175%) over 3 days |
Shodan's count of matching services on the whole internet, one point a day; the scope (your ranges) is never part of it. A count moves with Shodan's crawl as much as with patching, so read the direction, not the digit.
No CVE in this campaign: nothing an internet scanner keys on. Scope by product in your own tool.
Banner spellings: a model read 2 from the NVD names and this card's text (former and marketing names, console titles); 1 matched something on Shodan and is shown above, the rest was dropped.
Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-01 07:07Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.
Open questions
- The pipeline flagged one material development on watch, but today's story repeats [S1]/[S2]. What changed is not identifiable in the inputs.
- The pipeline's coverage scan lists vendor posts (Microsoft Security blog, Sophos) whose titles name this campaign. They are not provided as sources; the analyst should read them and add them if they change scope or IoCs.
- Is 2.1.314 the vendor-confirmed clean version? This is not shown in source text.
- Does Cursor or Anthropic confirm the 5,000-user ceiling and the root cause?
Sources
- [S1] https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html · The Hacker News
- [S2] https://github.com/anthropics/claude-code/releases · GitHub
Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically once it crosses the publish bar.