Posted on

2026-10-30 — Cursor Marketplace Claude Code 2.1.313 SSH Backdoor — Sentinel Hunts

Threat Overview

On October 29, 2026, a malicious build of the Claude Code VS Code extension (`Anthropic.claude-code` 2.1.313) was available through the Cursor extension marketplace for roughly 11 hours (02:27–13:35 Pacific). Cursor confirms the build was not developed by Anthropic and estimates at most 5,000 users were exposed. The loader ran when the extension activated, without a user starting a Claude conversation. It attempted to append an attacker-controlled SSH key (`svc-telemetry`), enable SSH, establish a reverse tunnel to `134.209.82.225`, install OS-specific persistence, and beacon host metadata to port 8099. Cursor states the SSH-enablement step usually failed on macOS and Windows without administrator privileges; persistence and reconnaissance attempts could still occur. This is a **Cursor marketplace artifact compromise**, not evidence that the official Microsoft Marketplace, Open VSX, or npm distributions were compromised. Early reporting incorrectly generalized the affected distribution; Cursor and the original researchers subsequently corrected the scope.

References

Impacted Systems

  • Vendor/product: Cursor editor extension marketplace distribution of `Anthropic.claude-code` (Claude Code for VS Code).
  • Confirmed malicious version: **2.1.313** downloaded/updated from Cursor marketplace during Oct 29, 2026, 02:27–13:35 PT; macOS ARM64 and Windows x64 VSIX hashes published. Researchers also describe a Linux payload branch, but distribution impact by OS is not fully established.
  • Unaffected/clarification: official Microsoft VS Code Marketplace, Open VSX and npm Claude Code packages have **not** been shown malicious; clean follow-up version **2.1.314**.
  • Deployment: developer workstations; extension executes under the logged-in editor account; no network-facing service prerequisite. Outbound TCP 22 to attacker and HTTP TCP 8099 attempted.
  • IOCs: `134.209.82.225`, SSH key comment `svc-telemetry`, `com.apple.sysmond` LaunchAgent, Windows `SysMon` scheduled task, `.smt`/`.smtk` files. Vendor VSIX SHA256: macOS `432ccdee3801f99e52b8fe31f69ea9870118e96ea7ef9ecabed1479621b5ab62`; Windows `3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081`.

Why this matters

The build targeted developer endpoints and potentially enabled access to cloud and CI credentials. An auto-updating extension could execute before a user interacts with the editor.

Exploitation Status

**Confirmed malicious distribution and payload behavior.** Cursor confirms the malicious build was distributed and reports up to 5,000 users potentially affected. Cursor and independent researchers verified backdoor/persistence code. Successful SSH access to individual machines has not been established by these sources; the attacker server was taken offline. The distribution entry point and operator remain unknown.

What this hunt looks for

Exact malicious extension hashes/version, attacker C2 connections, SSH reverse tunnels, authorized_keys changes, persistence files/tasks, and Windows process-creation fallbacks.

Required logs

  • DeviceNetworkEvents: 01 — First pass: reported attacker endpoint in Defender network telemetry
  • DeviceProcessEvents: 02 — Reverse SSH tunnel and autossh command line
  • DeviceFileEvents: 03 — Unauthorized SSH key or implant persistence files
  • DeviceProcessEvents: 04 — Windows SysMon task and SSH enablement commands
  • DeviceFileEvents: 05 — Compromised extension build written to disk
  • DeviceFileEvents: 06 — Reported malicious VSIX file hashes
  • DeviceNetworkEvents + DeviceProcessEvents: 07 — Network connection correlated with SSH tunnel process
  • SecurityEvent: 08 — Windows 4688 fallback: SSH tunnel, task, and beacon execution

KQL Hunting Content

01 — First pass: reported attacker endpoint in Defender network telemetry

DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| where RemoteIP == "134.209.82.225"
| project TimeGenerated, DeviceName, DeviceId, ActionType, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| order by TimeGenerated desc

02 — Reverse SSH tunnel and autossh command line

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName in~ ("ssh", "ssh.exe", "autossh", "autossh.exe") or ProcessCommandLine has "134.209.82.225"
| where ProcessCommandLine contains "134.209.82.225" or (ProcessCommandLine contains "-R" and ProcessCommandLine contains "localhost:22") or (ProcessCommandLine contains "autossh" and ProcessCommandLine contains "-M 0")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName
| order by TimeGenerated desc

03 — Unauthorized SSH key or implant persistence files

DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where ActionType in~ ("FileCreated", "FileModified", "FileRenamed")
| where (FileName =~ "authorized_keys" and (FolderPath contains ".ssh" or FolderPath contains "ProgramData\\ssh"))
    or FileName in~ (".smt", ".smtk", "smt.cmd", "smtk", "sysmon.cmd", "com.apple.sysmond.plist")
    or (FolderPath contains "LaunchAgents" and FileName =~ "com.apple.sysmond.plist")
| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| order by TimeGenerated desc

04 — Windows SysMon task and SSH enablement commands

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where (ProcessCommandLine contains "schtasks" and ProcessCommandLine contains "SysMon" and ProcessCommandLine contains "/create")
    or (ProcessCommandLine contains "OpenSSH.Server" and ProcessCommandLine contains "Add-WindowsCapability")
    or (ProcessCommandLine contains "systemsetup" and ProcessCommandLine contains "setremotelogin")
    or (ProcessCommandLine contains "com.apple.sysmond" and ProcessCommandLine contains "launchctl")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName
| order by TimeGenerated desc

05 — Compromised extension build written to disk

DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where FolderPath contains "anthropic.claude-code-2.1.313" or FileName contains "anthropic.claude-code-2.1.313"
| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

06 — Reported malicious VSIX file hashes

let BadHashes = dynamic(["432ccdee3801f99e52b8fe31f69ea9870118e96ea7ef9ecabed1479621b5ab62", "3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081"]);
DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where SHA256 in~ (BadHashes)
| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by TimeGenerated desc

07 — Network connection correlated with SSH tunnel process

let TunnelProcesses = DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName in~ ("ssh", "ssh.exe", "autossh", "autossh.exe")
| where ProcessCommandLine contains "-R" or ProcessCommandLine contains "134.209.82.225"
| project DeviceId, Pid=ProcessId, ProcessTime=TimeGenerated, ProcessCommandLine, DeviceName;
DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| where RemoteIP == "134.209.82.225" or (RemotePort == 22 and InitiatingProcessFileName in~ ("ssh", "ssh.exe", "autossh"))
| project NetworkTime=TimeGenerated, DeviceId, Pid=InitiatingProcessId, RemoteIP, RemotePort, ActionType, InitiatingProcessFileName
| join kind=inner (TunnelProcesses) on DeviceId, Pid
| where NetworkTime between (ProcessTime .. ProcessTime + 2h)
| project NetworkTime, DeviceName, RemoteIP, RemotePort, ActionType, InitiatingProcessFileName, ProcessCommandLine
| order by NetworkTime desc

08 — Windows 4688 fallback: SSH tunnel, task, and beacon execution

SecurityEvent
| where TimeGenerated >= ago(30d) and EventID == 4688
| extend Cmd = tostring(column_ifexists("CommandLine", "")), Proc = tostring(column_ifexists("NewProcessName", "")), Raw = tostring(column_ifexists("EventData", ""))
| where Cmd contains "134.209.82.225" or Cmd contains "svc-telemetry" or (Cmd contains "schtasks" and Cmd contains "SysMon") or (Raw contains "134.209.82.225")
| project TimeGenerated, Computer, Account, EventID, Proc, Cmd, Raw
| order by TimeGenerated desc

Detection Notes

  • Highest signal: exact attacker IP, exact VSIX hashes, and SSH reverse-tunnel command lines.
  • The `svc-telemetry` key content is not visible in normal DeviceFileEvents; file modification alone requires follow-up on the endpoint.
  • Windows scheduled task `SysMon` can collide with legitimate Sysmon-related administration. The malware attempts elevated execution, which often fails.
  • No malicious Open VSX, Microsoft Marketplace, or npm release is confirmed. Do not treat every installation of the legitimate extension as compromised.
  • Defender Device* tables require endpoint onboarding and connector ingestion; SecurityEvent 4688 requires command-line collection. macOS/Linux endpoints may not be covered.
  • 01 — First pass: reported attacker endpoint in Defender network telemetry: Exact reported C2 IP; successful connection not guaranteed. Port 22 is reverse SSH and 8099 is HTTP beacon.
  • 02 — Reverse SSH tunnel and autossh command line: Strongest behavioral process signal; can also match authorized administrator tunnels if not tied to IOC.
  • 03 — Unauthorized SSH key or implant persistence files: Authorized_keys modifications are not unique to this incident; inspect file content for svc-telemetry. Defender file events do not include contents.
  • 04 — Windows SysMon task and SSH enablement commands: Exact reported persistence/task names are stronger than generic SSH service changes; legitimate Sysmon monitoring may use similar task naming.
  • 05 — Compromised extension build written to disk: Version detection is exposure evidence, not proof of malicious loader execution. Verify distribution origin; only Cursor marketplace build confirmed malicious.
  • 06 — Reported malicious VSIX file hashes: Vendor-provided VSIX hashes for macOS ARM64 and Windows x64; SHA256 may be absent for some file events.
  • 07 — Network connection correlated with SSH tunnel process: PID reuse can create false joins; correlation window limits but does not eliminate this risk.
  • 08 — Windows 4688 fallback: SSH tunnel, task, and beacon execution: Requires 4688 command-line auditing; EventData fallback is a best effort, not a guarantee of command visibility.