Inside a malicious Claude Code-branded extension and its persistent SSH backdoor

What it is

On 29 October 2026, a tampered copy of the anthropic.claude-code extension (versions 2.1.312 and 2.1.313) was served from the Cursor extension marketplace. Cursor reports it was live from about 2:27 AM to 1:35 PM PDT. Microsoft Threat Intelligence analyzed the injected JavaScript. The VS Code Marketplace and the npm package @antropic-ai/claude-code were not affected. Anthropic told Microsoft its systems were not compromised and it did not build the package.

How it works

The injected function runs when the module loads, before normal extension code. It uses Node.js APIs and built-in system tools, downloads no second executable, hides command output, and swallows errors. The extension keeps working normally.

1. It collects hostname, username, OS, architecture, home and working directories, and the global Git email. It also lists up to forty environment-variable names containing KEY, TOKEN, SECRET, PASS, AWS or GCP. Names are sent, not values.
2. It checks authorized_keys for the comment svc-telemetry and, if absent, appends an embedded Ed25519 public key.
3. It writes a tunnel private key to a hidden file named .stk_ plus ten hex characters, then connects as user tunnel with -N -R '*:0:localhost:22'. Host-key checking is disabled. Unix-like systems prefer autossh and fall back to ssh. Windows uses a hidden PowerShell loop. Retries wait sixty seconds.
4. It writes persistence outside the extension directory, using names that imitate monitoring software (SysMon, com.apple.sysmond).
5. A delayed callback sends the collected host details.

Preconditions / Affected

Affected hosts installed or auto-updated to 2.1.312 or 2.1.313 from the Cursor marketplace. Remote access also needs the local SSH service to accept the connection and the attacker's server to allow the tunnel. Cursor reports that errors and administrator-permission requirements blocked SSH access on most macOS and Windows hosts. Key and persistence files may still be written when the tunnel fails.

What to do

Preserve evidence first: the extension package, SSH authorization files, generated keys and scripts, and startup configuration. Isolate devices showing loader execution. Then:

• Check ~/.ssh/authorized_keys for svc-telemetry on macOS and Linux. On Windows also check %USERPROFILE%\.ssh\authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys. Confirm against the fingerprint in the IOC list, then remove only that entry.
• macOS: unload and remove ~/Library/LaunchAgents/com.apple.sysmond.plist, ~/.config/.smt and ~/.config/.smtk.
• Linux: remove the user-crontab @reboot entry referencing ~/.config/.smt, plus the script and ~/.config/.smtk.
• Windows: remove the SysMon scheduled task, the Startup-folder sysmon.cmd, and %USERPROFILE%\.config\smt.cmd and smtk.
• All platforms: stop the SSH and retry processes and delete the .stk_ files.
• Remove the extension. Removing it does not clear the files written outside its directory.
• Rotate credentials and revoke sessions from a clean device if telemetry shows credential access or device trust cannot be restored.
• Restrict Cursor extensions to approved publishers and set an installation cooldown for new versions.

Hunting leads from the post (Defender XDR, 30-day lookback):

DeviceNetworkEvents
 | where Timestamp > ago(30d)
 | where RemoteIP == "134.209.82.225"
     or RemoteUrl has "134.209.82.225"

The file query matches SHA-256 ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15, the filenames .smt, .smtk, smt.cmd, smtk, sysmon.cmd and com.apple.sysmond.plist, and the prefix .stk_. The scheduled-task query looks for ScheduledTaskCreated events whose AdditionalFields contain both "SysMon" and "smt". The macOS query looks for PlistPropertyModified events on com.apple.sysmond.plist.

Caveats

Microsoft states each query result is a lead, not proof of compromise. SHA-256 values may be missing from some file events. A persistence artifact alone does not show the startup mechanism ran, and a missing svc-telemetry marker does not clear a host. The post does not attribute the activity to a threat actor. Cursor's takedown of the server does not remove artifacts already on devices. Cursor's own security notice carries cleanup scripts, which the post says to review before running.