Microsoft Analyzes Malicious Claude Code Extension’s Persistent SSH Backdoor

Summary

Microsoft analyzed a tampered Claude Code extension briefly listed on Cursor’s marketplace. Its injected code attempted to install SSH access, create reverse tunnels, establish persistence, and report host details; successful access was not confirmed on every host.

Key points

Cursor reported the tampered extension versions 2.1.312 and 2.1.313 were available for several hours. Microsoft says the packages were not distributed through Visual Studio Marketplace or npm, and Anthropic said its systems were not compromised.
The injected JavaScript ran before normal extension initialization and collected host details plus names of potentially sensitive environment variables—not their values.
The loader attempted to add an SSH public key labeled svc-telemetry and use a separate identity for an outbound reverse SSH tunnel to the workstation’s local port 22.
Persistence attempts varied by platform: a macOS LaunchAgent, a Linux user-crontab entry, and Windows scheduled-task or Startup-folder mechanisms.
These were analyzed capabilities and attempted actions, not proof that every step succeeded. Cursor reported that permissions and SSH configuration blocked access on most macOS and Windows hosts.
Microsoft recommends investigating extension installation and endpoint, network, file, process, and authentication telemetry; preserving evidence before cleanup; and removing confirmed malicious artifacts. Removing the extension alone does not remove artifacts written elsewhere.

Article Details

Attack Vectors: A tampered Claude Code-branded extension, versions 2.1.312 and 2.1.313, was available in the Cursor Extension Marketplace for several hours. Microsoft reports that the packages were not distributed through the Visual Studio Marketplace or npm, and that the evidence points to the incident being limited to Cursor Marketplace.
Injected JavaScript ran before the extension’s expected code and collected host details, attempted to add an SSH authorized key, enable SSH, establish reverse SSH forwarding, configure platform-specific persistence, and report selected host details.
The loader attempted persistence through a macOS LaunchAgent, a Linux user-crontab @reboot entry, and a Windows scheduled task or Startup-folder batch-file fallback. Artifact presence alone does not establish that persistence succeeded.
Successful remote access depended on host privileges, SSH configuration, and the remote server’s configuration; Cursor reported that errors and permission requirements blocked SSH access on most macOS and Windows hosts.
Defensive Notes: Identify systems that installed or automatically updated to anthropic.claude-code versions 2.1.312 or 2.1.313 through Cursor Marketplace; preserve evidence and correlate extension, endpoint, network, file, process, and authentication telemetry.
Before cleanup, preserve the extension package, SSH authorization files, generated keys and scripts, and startup configuration. Isolate devices with evidence of loader execution or backdoor installation.
Inspect authorized_keys and confirm any suspicious key against the reported fingerprint before removing the exact unauthorized entry. Inspect startup objects’ configured actions; names alone do not establish that they are malicious.
Remove confirmed malicious extension and persistence artifacts separately, including unauthorized SSH keys, tunnel identities, scripts, startup entries, and temporary .stk_ identity files. Removing or updating the extension does not remove artifacts written outside its installation directory.
Review telemetry for SSH key acceptance, tunnel processes, local SSH sessions, command execution, and file activity. Rotate credentials or revoke sessions from a known-clean device when investigation indicates credential access or device trust cannot be restored.
Cursor users can restrict extensions to approved publishers and configure an extension installation cooldown to delay installation of newly published versions.

Indicators of compromise

Type	Indicator	Context
IPV4	`134[.]209[.]82[.]225`	Reported remote address configured as an SSH and HTTP destination for the analyzed sample.
SHA256	`7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278`	SHA-256 of the decoded tunnel private-key file associated with the malicious sample.
SHA256	`ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15`	SHA-256 of the malicious JavaScript entry point; the article notes this is not a Visual Studio extension package hash.
URL	`hxxp[:]//134[.]209[.]82[.]225:8099/beacon`	Reported reconnaissance endpoint used by the sample to attempt to send collected host details.