Malicious Claude Code extension with SSH backdoor was live on Cursor marketplace for 11 hours
- Severity
- High
- Sources
- 2
What happened
Cursor confirmed that Anthropic.claude-code 2.1.312 and 2.1.313 were distributed via the VS Code Extension Marketplace for about 11 hours on 29 October 2026, targeting Windows and macOS. The payload added an attacker-controlled key (svc-telemetry) to authorizedkeys, attempted to enable SSH, opened a reverse tunnel, and used a LaunchAgent (com.apple.sysmond) or scheduled task (SysMon) for persistence, beaconing roughly every 60 seconds. Defenders should check for these versions, inspect authorizedkeys, review network logs for SSH on TCP 22 and POST /beacon on port 8099, and isolate hosts with evidence of execution. Removing the extension alone is insufficient; rotate credentials from a trusted system.
For security analysts · Written by AI from 2 sources · Wrong?
What to do
- Check whether Anthropic.claude-code versions 2.1.312 or 2.1.313 are installed and remove them.
- Inspect authorised SSH keys for an entry labelled svc-telemetry and remove it if found.
- Review extension installation records, endpoint alerts and network logs for the indicators Cursor published.
- Isolate affected hosts where payload execution or backdoor installation is evident, then rotate accessible credentials and sessions from a trusted system.
Written by AI from the sources, checked against them
Full story timeline · 2 updates
Who reported · 2 outlets
Who and what is in it
Products