Cutsign — Trojanized Claude Code extension 2.1.313 on Cursor Marketplace adds SSH key, persistence and beacon

AI-generated verdict card, published automatically by the pipeline. Version 6, as of 2026-11-01; hype score 6. Written by a model from the stored public sources and not reviewed by a person; re-issued in place when the evidence changes (the URL stays). The detection-coverage table below is checked automatically from public sources and re-checked daily. Supersedes version 5. All cards

Trojanized Claude Code extension 2.1.313 on Cursor Marketplace adds SSH key, persistence and beacon

Hunt / IR + PatchP1confidence: mediumP1 +2deep read +1primary source +1material development on watch +2

A malicious build (2.1.313) of the Claude Code extension was distributed through the Cursor Marketplace for about 11 hours on Oct 29, 2026, reaching at most 5,000 users [S1]. Today, find any developer host that received it, then hunt for the 'svc-telemetry' SSH key, IDE-spawned persistence and traffic to 134.209.82.225.

Triage: The backdoor reached developer workstations through an auto-updating marketplace, and the reporting gives concrete artifacts to hunt today. [S1]

The core facts come from reputable secondary reporting [S1]. The pipeline attributes artifact quotes to the vendor release page [S2], but no Anthropic or Cursor text appears directly in the inputs.

Changed since version 5

No change to facts, scope or hunts. Today's story restates [S1] and the pipeline now quotes artifacts as from [S2]; the gap stays because no S2 text is shown.
Added re-entry trigger and open question for the Microsoft Security and Sophos posts listed by the pipeline; they are not yet sources.

What happened

Version 2.1.313 of anthropic.claude-code was served by the Cursor Marketplace from about 2:27 a.m. to 1:35 p.m. PT on Oct 29, 2026, reaching at most 5,000 users. [S1]
A 66-line JS loader adds an attacker SSH key labelled 'svc-telemetry' to ~/.ssh/authorized_keys and tries to enable SSH. [S1]
It opens a reverse tunnel to 134.209.82.225 and installs a scheduled task, crontab entry or LaunchAgent for persistence. [S1]
It sends host recon, including the global Git email, over unencrypted HTTP to 134.209.82.225:8099/beacon. [S1]
Enabling SSH fails without admin rights on most macOS/Windows hosts, but the key, persistence and beacon still occur. No follow-on payloads were observed. [S1]

Timeline

2026-10-29 ~02:27 PT	Malicious 2.1.313 becomes available on the Cursor Marketplace. S1
2026-10-29 ~13:35 PT	Distribution window ends. S1
2026-10-30	Public reporting of the trojanized extension and its IoCs. S1

Detect

svc-telemetry key in authorized_keys · FIM / EDR file events on ~/.ssh/authorized_keys

index=* (file_path="*/.ssh/authorized_keys" OR TargetFilename="*authorized_keys") "svc-telemetry" | stats count min(_time) as first max(_time) as last by host, user, file_path, process_name

FROM logs-* | WHERE file.path LIKE "*/.ssh/authorized_keys" OR file.path LIKE "*authorized_keys" | WHERE file.path LIKE "*authorized_keys*" | STATS count = COUNT(*), first = MIN(@timestamp), last = MAX(@timestamp) BY host.name, user.name, file.path, process.name

A hit means: The attacker key was planted on this host. Treat the host as compromised and check whether SSH is enabled.

Traffic to C2 134.209.82.225 · Firewall / proxy / EDR network events

index=* (dest_ip="134.209.82.225" OR dest="134.209.82.225" OR url="*134.209.82.225*") | stats count min(_time) as first max(_time) as last by src_ip, user, dest_port, process_name, url

A hit means: Port 8099 means the beacon sent host recon. Other ports, especially an SSH session, suggest the reverse tunnel was established.

Persistence created by the IDE · EDR process/file events, Windows 4698, macOS LaunchAgents FIM

index=* earliest="10/29/2026:00:00:00" (parent_process_name="*Cursor*" OR process_name="*Cursor*") (process_name IN ("schtasks.exe","crontab","launchctl") OR EventCode=4698 OR file_path="*/Library/LaunchAgents/*") | stats count by host, user, process_name, command_line, file_path

FROM logs-* | WHERE @timestamp >= "2026-10-29T00:00:00" | WHERE process.parent.name LIKE "*Cursor*" OR process.name LIKE "*Cursor*" | WHERE process.name IN ("schtasks.exe", "crontab", "launchctl") OR event.code == "4698" OR file.path LIKE "*/Library/LaunchAgents/*" | STATS count = COUNT(*) BY host.name, user.name, process.name, process.command_line, file.path

A hit means: The Cursor process tree created a scheduled task, cron entry or LaunchAgent. This likely matches the loader's persistence.

Beacon pattern and IP lookup from IDE · Proxy

index=* ((dest_port=8099 uri_path="/beacon") OR (url="*api.ipify.org*" (process_name="*Cursor*" OR process_name="*node*"))) | stats count by src_ip, user, url, process_name

A hit means: This matches the beacon behaviour and should catch it if the C2 IP changes. An ipify request alone is weaker and needs corroboration.

Verify

Confirm the extension version on the host is 2.1.313 and that it was installed from the Cursor Marketplace inside the Oct 29 window. [S1]
A true positive should show the 'svc-telemetry' key together with an IDE-spawned persistence entry or traffic to 134.209.82.225. [S1]
Benign look-alikes include legitimate tools calling api.ipify.org, admins adding SSH keys, and extensions creating scheduled tasks for updates. None of these should carry the 'svc-telemetry' label or point at the C2 IP.
IDEs commonly run `git config --global user.email`. Only count it when it sits in the same 2.1.313 extension-host process tree.

Scope

Affected

anthropic.claude-code 2.1.313 installed via the Cursor Marketplace, about 2:27 a.m.–1:35 p.m. PT Oct 29, 2026; at most 5,000 users [S1]

Only if

Installed or auto-updated in Cursor IDE from the Cursor Marketplace during the window [S1]
Attacker SSH login through the tunnel requires the local SSH service to be enabled, which needs admin rights on most macOS/Windows hosts [S1]

Not affected if

Extension is not at version 2.1.313 [S1]
Extension was installed from Open VSX or the Microsoft VS Code Marketplace (per pipeline exposure data; confirm in [S1])

Fixed in: 2.1.314 (pipeline exposure data; confirm against [S2])

Enumerate

Hosts with Cursor IDE installed, with their extension versions and install times
Developer users whose global Git email may have been sent in the beacon
Hosts where SSH/sshd was enabled or running on Oct 29 or later
Users with local admin rights among affected hosts
Secrets reachable from affected user profiles: SSH keys, cloud tokens, repo credentials

Contain

Block 134.209.82.225 at egress and alert on any further attempts. [S1]
Before removing anything, preserve copies of authorized_keys, the persistence entries, the extension folder and network logs.
Isolate hosts that show the key plus a tunnel or SSH connection.
Remove or update the 2.1.313 extension. Pause extension auto-update in Cursor until the publisher's status is confirmed.
As a precaution, rotate credentials reachable from hosts where SSH was enabled and the tunnel was seen. Rotation cannot be undone. The sources report no credential theft or follow-on payloads. [S1]

Eradicate

Remove the 'svc-telemetry' key from ~/.ssh/authorized_keys. [S1]
Delete the scheduled task, crontab entry or LaunchAgent created by the loader. [S1]
Uninstall 2.1.313 and remove its extension folder. [S1]
Disable SSH where the loader enabled it and it is not needed. [S1]

Recover

Before returning a host, confirm a clean extension version, no 'svc-telemetry' key and no IDE-created persistence.
Afterwards, monitor for traffic to 134.209.82.225, port 8099 /beacon, and new authorized_keys writes from IDE processes.

Re-enter the loop when

A new C2 address, key label or loader variant is reported.
Follow-on payloads or credential theft are reported for any victim.
Anthropic or Cursor publish an advisory that changes the window, version range, marketplace list or user count.
Vendor research posts (the pipeline lists Microsoft Security and Sophos write-ups) add IoCs not in [S1].
Any hunt hits on a host outside the expected Cursor install base.

Debrief

Record affected hosts, install times, the source marketplace and whether SSH was enabled on each.
Record whether extension auto-update and marketplace sourcing are controlled for developer IDEs.
Gap: the pipeline attributes artifact quotes to the vendor release page [S2], but no Anthropic or Cursor text is shown directly in the inputs.
Gap: how the build entered the Cursor Marketplace (publisher account compromise or a marketplace issue) is not stated.
Gap: the basis for the 'at most 5,000 users' figure is not given.

Detection coverage — checked automatically

Category	Source	Status
Vendor	Impacted vendor / CERT advisory	published — primary source among the thread's sources: https://github.com/anthropics/claude-code/releases
Government	CISA KEV	not checkable — no CVE: the catalog is keyed by CVE
EDR / endpoint VM	CrowdStrike blog	published — CrowdStrike Secures AI Agents Inside Claude Cowork (names the campaign in the title; the feed text carries no CVE id)
EDR / endpoint VM	Microsoft Security blog	published — Fake-download campaign uses trojanized installers to deliver monetization payloads · Inside a malicious Claude Code-branded extension and its persistent SSH backdoor (names the campaign in the title; the feed text carries no CVE id)
EDR / endpoint VM	SentinelOne blog	published — Bring Your Own Vulnerable Driver: How EDR Killing Became an Industry (names the campaign in the title; the feed text carries no CVE id)
EDR / endpoint VM	SentinelOne Labs	nothing found — no post names it among the feed's 10 newest items
WAF / edge	Akamai blog	nothing found — no post names it among the feed's 1183 newest items
WAF / edge	Cloudflare WAF managed-ruleset changelog	nothing found — no post names it among the feed's 139 newest items
Cloud / container	Wiz blog	nothing found — no post names it among the feed's 717 newest items
IDS / research	Cisco Talos blog	published — Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer · IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases · Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN (names the campaign in the title; the feed text carries no CVE id)
Detection content	Elastic detection rules	published — 34 files name Trojanized / Claude / Cursor: rules/macos/command_and_control_suspicious_curl_from_macos_application.toml, rules/macos/discovery_suspicious_sip_check.toml, rules/macos/discovery_full_disk_access_check.toml, rules/macos/persistence_ssfilecopyreceiver_file_writes.toml
Detection content	Elastic Security Labs	published — Modernising threat hunting: Using Semantic Search to Find Risky AI Agent Behavior · Auditing the auditor: Unmasking Apex Accelerator · No MDM for Linux? A 68-line Elastic workflow keeps every endpoint's config current (names the campaign in the title; the feed text carries no CVE id)
Detection content	SigmaHQ rules	published — 15 files name Trojanized / Claude / Cursor: rules-emerging-threats/2023/TA/Lazarus/README.md, rules/windows/process_creation/proc_creation_win_lolbin_gather_network_info.yml, rules-emerging-threats/2023/TA/Lazarus/image_load_apt_lazarus_side_load_activity.yml, rules/windows/process_creation/proc_creation_win_susp_gather_network_info_execution.yml
Detection content	Splunk ESCU	published — 36 files name Trojanized / Claude / Cursor: stories/gomir.yml, stories/salat_stealer.yml, stories/meduza_stealer.yml, stories/starland_rat_campaign.yml
MSSP / IR firms	Arctic Wolf blog	nothing found — no post names it among the feed's 10 newest items
MSSP / IR firms	Huntress blog	nothing found — no post names it among the feed's 754 newest items
MSSP / IR firms	Rapid7 blog	published — Gartner Report: The Attack Path is Closing Faster than Most Teams Can Patch (names the campaign in the title; the feed text carries no CVE id)
MSSP / IR firms	Sophos threat research	published — Malicious Claude Code extension distributed through Cursor marketplace (names the campaign in the title; the feed text carries no CVE id)
Research	Unit 42	nothing found — no post names it among the feed's 15 newest items

Checked automatically 2026-11-10 04:09Z from public sources: 11 published, 7 nothing found, 1 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

What a person would still look up (4)

EDR / endpoint	Check whether your EDR records authorized_keys writes and scheduled task, cron and LaunchAgent creation with the Cursor extension host as parent.
Firewall / proxy	Check that egress logs capture destination IP, port and URI path for HTTP to port 8099, and that 134.209.82.225 is blocked.
Asset / software inventory	Check whether inventory reports IDE extensions with versions and install source for Cursor.
Detection content	Check vendor and community rule repositories for content naming this extension or its IoCs, and test it against the hunts above.

Exposure queries — generated automatically

shodan · alias · card

http.html:"Cursor Marketplace"

open · Banner spelling suggested by the model from the card text (distribution channel named in the card; appears on marketplace pages); counted against Shodan before it was shown.

1services internet-wide on Shodan · 2026-11-10▼ 4 on 2026-10-30 (-3 -75%) · 1 on 2026-11-09 (+0 +0%)

Internet-wide count, trend

Query	First	Latest	Change
`http.html:"Cursor Marketplace"`	4 2026-10-30	1 2026-11-10	-3 (-75%) over 12 days

Shodan's count of matching services on the whole internet, one point a day; the scope (your ranges) is never part of it. A count moves with Shodan's crawl as much as with patching, so read the direction, not the digit.

No CVE in this campaign: nothing an internet scanner keys on. Scope by product in your own tool.

Banner spellings: a model read 2 from the NVD names and this card's text (former and marketing names, console titles); 1 matched something on Shodan and is shown above, the rest was dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-10 04:09Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

Is 2.1.314 confirmed as the clean version in the Anthropic release notes [S2]?
Does Anthropic or Cursor state how the malicious build was published?
Do the Microsoft Security and Sophos posts the pipeline flags add IoCs or scope? They are not in this card's sources.
What is the basis for the 5,000-user ceiling?

Sources

[S1] https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html · The Hacker News
[S2] https://github.com/anthropics/claude-code/releases · GitHub

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically; a dismissed draft unpublishes it.