Published on November 2, 2026
Malicious Claude Code Extensions in Cursor Marketplace Install Persistent SSH Backdoors on Windows and macOS
Severity
Medium
Malicious versions of the Anthropic Claude Code extension were distributed through the Cursor VS Code Extension Marketplace on October 29, 2026. The affected versions, 2.1.312 and 2.1.313, were available between approximately 2:27 a.m. and 1:35 p.m. Pacific Time. Cursor confirmed that the modified packages were not developed by Anthropic and reported no evidence that other versions or the official distribution were affected.
The malicious extensions attempted to establish persistent SSH backdoors on Windows and macOS systems, potentially enabling unauthorized remote access. The payload collected system information, including hostnames, usernames, operating systems, processor architectures, home directory paths, working directories, Git email addresses, public IP addresses, and environment variable names. The malware also attempted to insert an attacker-controlled SSH public key into authorized key files, enable the SSH service, and establish a reverse SSH tunnel to the attacker-controlled IP address 134[.]209[.]82[.]225 over TCP port 22. System information was transmitted through HTTP POST requests to a beacon endpoint on port 8099.
Although administrator privileges were generally required to enable SSH, Cursor confirmed that some malicious activities, including unauthorized SSH key insertion, persistence installation, and host-information transmission, had occurred. The incident highlights the risks associated with malicious software extensions distributed through trusted developer marketplaces.
How?
The attack began when developers installed one of the compromised Claude Code extension versions. Once executed, the modified extension.js collected system reconnaissance data and attempted to transmit it to the attacker’s infrastructure.
To establish persistent access, the payload attempted to add an unauthorized SSH public key and create a reverse SSH tunnel using legitimate SSH functionality. Background scripts repeatedly attempted to reconnect approximately every 60 seconds.
On macOS, persistence was implemented through a LaunchAgent named com.apple.sysmond.plist, located in ~/Library/LaunchAgents/, with supporting files stored under ~/.config/. On Windows, the malware attempted to create a scheduled task named SysMon running with SYSTEM privileges, with a Startup-folder script serving as a fallback.
However, privilege restrictions and implementation errors limited the attack’s effectiveness in typical execution scenarios. Cursor subsequently removed the malicious packages, temporarily suspended the marketplace, rotated keys, audited access, rebuilt the service, and worked with its hosting provider to disable the attacker’s infrastructure.
Conclusion
Organizations should identify systems where the affected extension versions were installed and investigate endpoint logs, extension installation records, SSH activity, scheduled tasks, LaunchAgents, and network connections for indicators of compromise.
Remove unauthorized SSH keys, malicious persistence files, scheduled tasks, and associated processes. Uninstalling the extension alone is insufficient because the backdoor components may remain on the system.
Block the identified attacker IP address and associated indicators across relevant security controls, including firewalls, EDR/XDR platforms, and SIEM solutions. Rotate potentially exposed credentials, SSH keys, and active sessions from a trusted device, and assess whether affected systems require rebuilding.
Monitor for suspicious outbound SSH connections over TCP port 22 and HTTP POST requests to port 8099. Organizations should also restrict extension installation to approved sources and versions, review developer environment permissions, and establish controls to detect unauthorized changes to SSH configurations and persistence mechanisms.
IOCs
| Type | Indicator | Context |
| Extension identifier | Anthropic.claude-code | Affected versions: 2.1.312, 2.1.313 |
| Attacker IP | 134[.]209[.]82[.]225 | Infrastructure reported disabled |
| Reverse SSH destination | tunnel@134[.]209[.]82[.]225:22 | Outbound SSH tunnel |
| External beacon | hxxp://134[.]209[.]82[.]225:8099/beacon | HTTP POST reconnaissance |
| Loopback beacon | 127[.]0[.]0[.]1:8099/beacon | Local HTTP POST attempt; correlate with other evidence |
| Unauthorized key comment | svc-telemetry | Search SSH authorization files |
| Unauthorized key fingerprint | SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk | Attacker-added SSH key |
| Reverse-tunnel key fingerprint | SHA256:KOAU57+ZG6u3MG4WwzPzPX2O5YEe9qdOC1Bl+6MVyDQ | Tunnel authentication key |
| Payload SHA-256 | ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15 | Modified payload |
| Windows 2.1.313 VSIX SHA-256 | 6786ec90cbd45949695bd7805c9fbb26cfc91bc5fc897de0183d9bcb9cb21731 | Malicious Windows package |
| macOS LaunchAgent | ~/Library/LaunchAgents/com.apple.sysmond.plist | Label: com.apple.sysmond |
| macOS supporting files | ~/.config/.smt, ~/.config/.smtk | Persistence and tunnel artifacts |
| Windows supporting files | %USERPROFILE%\.config\smt.cmd, %USERPROFILE%\.config\smtk | Standalone artifacts |
| Windows scheduled task | SysMon | Attempts SYSTEM execution |
| Windows Startup fallback | %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd | Startup persistence |
| Temporary artifacts | $TMPDIR/.stk_<10 hex>; %TEMP%\.stk_<10 hex> | macOS and Windows temporary files |
Source
https://gbhackers.com/malicious-claude-code-extensions-in-cursor-marketplace/