Trojanized Claude Code Extension Added SSH Persistence to Windows and macOS
Summary
Version 2.1.313 of a malicious Claude Code extension was distributed through Open VSX and Cursor for about 11 hours, adding an attacker SSH key and persistence on Windows and macOS. Cursor says at most 5,000 users were affected; the attacker server is offline.
Key points
- On October 29, 2026, version 2.1.313 was distributed through Open VSX and the Cursor extension marketplace for roughly 11 hours; it appeared under the legitimate publisher identity, and how it entered the registry is unknown.
- Cursor confirmed the incident, said the build was not developed by Anthropic, and estimated that at most 5,000 users were affected.
- The extension collected host and user details, added an attacker-controlled SSH key labeled svc-telemetry, and attempted to establish a reverse SSH tunnel.
- It attempted to enable the local SSH server, but this generally failed because the extension lacked admin rights; the SSH key and persistence were still installed.
- Persistence included a macOS LaunchAgent or a Windows scheduled task, with attempts to retry the tunnel about every 60 seconds.
- The hosting provider took the attacker server offline. Cursor advises treating any machine that ran the build as potentially exposed.
- Recommended response includes isolating affected hosts, removing the key and persistence, rotating accessible credentials from a trusted system, and hunting across endpoint, network, and extension-install logs. Updating or uninstalling the extension alone does not remove the backdoor.
Article Details
- Incident Type
- Trojanized extension distributed through software marketplaces, enabling persistent remote access to developer workstations
- Incident Date
- 2026-10-29
- Data Types Exposed
- Host and user details
- Affected Records
- Cursor said at most 5,000 users were affected; the exact number is not disclosed.
- Operational Impact
- The malicious extension added an attacker-controlled SSH key and persistence to affected Windows and macOS machines and attempted to establish a reverse SSH tunnel. Enabling the local SSH server generally failed because it required administrator rights. Cursor worked with the hosting provider to take the attacker server offline. The article says machines that ran the build should be treated as potentially exposed.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 134[.]209[.]82[.]225 | Attacker-controlled server used for reverse SSH on TCP port 22 and an HTTP beacon on port 8099 at /beacon. |
MITRE ATT&CK
T1053.005 · Scheduled TaskOn Windows, the extension installed persistence through a scheduled task named SysMon.T1098.004 · SSH Authorized KeysThe extension added an attacker-controlled public key to the user's SSH authorized_keys file.T1543.001 · Launch AgentOn macOS, the extension installed persistence through a LaunchAgent.T1572 · Protocol TunnelingThe extension attempted to establish a reverse SSH tunnel to the attacker-controlled server.
Vendors
Products
Claude CodeOn October 29, 2026, a malicious build of the Claude Code extension, version 2.1.313, was distributed to developers through the Open VSX registry and the Cursor extension marketplace.CursorOn October 29, 2026, a malicious build of the Claude Code extension, version 2.1.313, was distributed to developers through the Open VSX registry and the Cursor extension marketplace.Open VSXOn October 29, 2026, a malicious build of the Claude Code extension, version 2.1.313, was distributed to developers through the Open VSX registry and the Cursor extension marketplace.