# Malicious Anthropic.claude-code extension version 2.1.313 distributed via Cursor Extension Marketplace (SSH backdoor and persistence on macOS and Windows)

> Cursor reported that a malicious version (2.1.313) of the Anthropic.claude-code extension was available on the Cursor extension marketplace for macOS (darwin-arm64) and Windows (win32-x64) on 2026-10-29 from 2:27 AM PT until it was removed at 1:35 PM PT. The package collected host and user data, tried to add an attacker SSH key and enable SSH with a reverse tunnel, installed persistence, and reported to 134.209.82.225; at most 5,000 users were affected.

- **Published:** 2026-10-30T11:06:49Z
- **Last reviewed:** 2026-10-31T02:38:24.796Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4820
- **ID:** TL-2026-4820
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 42 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-10-29 at 2:27 AM PT a malicious build of the Anthropic.claude-code extension, version 2.1.313, became available through the Cursor VS Code extension marketplace. Cursor detected the incident and removed it at 1:35 PM PT the same day (about 11 hours). Only the darwin-arm64 (macOS Apple silicon) and win32-x64 (Windows) packages were malicious. Cursor states that at most 5,000 users were affected. The vendor notice does not describe how the malicious version reached the marketplace, and no CVE, CVSS score or threat-actor attribution has been published.

Per Cursor's notice the extension performs four actions in sequence. (1) It collects system data: hostname, username, OS type, architecture, home directory, environment variable names, working directories, Git email and public IP address. (2) It attempts to append an attacker ed25519 SSH public key (comment 'svc-telemetry') to authorized_keys, enable the SSH service (systemsetup -setremotelogin on on macOS; Add-WindowsCapability OpenSSH.Server on Windows) and establish a reverse tunnel (ssh -N -R '*:0:localhost:22', or autossh -M 0, with StrictHostKeyChecking=no, UserKnownHostsFile=/dev/null, ServerAliveInterval=30 and ServerAliveCountMax=3) to tunnel@134.209.82.225:22. This step fails on most systems because it requires administrator privileges. (3) It installs persistence that retries the tunnel roughly every 60 seconds: a LaunchAgent (~/Library/LaunchAgents/com.apple.sysmond.plist, label com.apple.sysmond) on macOS, and a scheduled task named 'SysMon' (which attempts to run as SYSTEM) plus a Startup-folder script sysmon.cmd on Windows. Helper files include ~/.config/.smt, ~/.config/.smtk (smt.cmd and smtk on Windows) and a temp file named .stk_<10 hex>. (4) It posts host details and backdoor status over HTTP to the /beacon endpoint on port 8099 of 134.209.82.225; a loopback beacon (127.0.0.1:8099/beacon) is also listed as an indicator.

Response: Cursor removed the malicious version, blocked further distribution, temporarily shut down the marketplace, audited access and confirmed no other extensions were compromised, rotated cryptographic keys, rebuilt marketplace infrastructure and coordinated with the hosting provider to take the attacker server offline. The hunt record states the vendor assessed the attacker server as no longer functioning and most privilege-escalation attempts as failed, so the incident is treated as contained. Hosts that installed 2.1.313 may nevertheless retain persistence artifacts and an authorized SSH key; Cursor warns that uninstalling the extension may not be sufficient because the payload drops standalone persistence scripts. Cursor provides a one-line check for the svc-telemetry key in authorized_keys (and C:\ProgramData\ssh\administrators_authorized_keys on Windows) and remediation scripts remediate-macos.sh (run as the affected user, not root) and remediate-windows.ps1 (run as Administrator). The notice says environment variable names, not values, were collected; credentials in affected developers' environments may still warrant review as a precaution.

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1059.004 Unix Shell
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1098.004 SSH Authorized Keys
- T1133 External Remote Services
- T1543.001 Launch Agent
- T1053.005 Scheduled Task
- T1547.001 Registry Run Keys / Startup Folder
- T1036.005 Match Legitimate Resource Name or Location
- T1564.001 Hidden Files and Directories
- T1021.004 SSH
- T1572 Protocol Tunneling
- T1071.001 Web Protocols
- T1059.007 Command and Scripting Interpreter
- T1016 System Network Configuration Discovery
- T1041 Exfiltration Over C2 Channel
- T1053.003 Scheduled Task/Job
- T1571 Non-Standard Port

## Sources

- [Security notice - malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplace](https://cursor.com/blog/claude-code-extension-security-notice)
- [Cursor Extensions Marketplace security (Open VSX) - Cursor community forum (earlier marketplace concerns)](https://forum.cursor.com/t/cursor-extensions-marketplace-security-open-vsx/125429)
- [How to not lose $500k to a malicious Cursor extension (related earlier Cursor extension incident)](https://dev.to/jfbloom22/how-to-not-loose-500k-to-a-malicious-cursor-extension-50h6)
- [MITRE ATT&CK T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain](https://attack.mitre.org/techniques/T1195/002/)
- [MITRE ATT&CK T1098.004 - Account Manipulation: SSH Authorized Keys](https://attack.mitre.org/techniques/T1098/004/)
- [MITRE ATT&CK T1572 - Protocol Tunneling](https://attack.mitre.org/techniques/T1572/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4820