Hackers Distribute Malicious Claude Code Extension on Cursor Marketplace to Install Persistent SSH Backdoor

Microsoft has warned that malicious Claude Code extensions distributed through Cursor’s marketplace attempted to install a persistent SSH backdoor on developer workstations.

The trojanized packages, anthropic.claude-code versions 2.1.312 and 2.1.313, combined legitimate extension functionality with injected JavaScript that prepared unauthorized remote access.

Cursor disclosed the incident on October 29, 2026, reporting availability between approximately 2:27 AM and 1:35 PM PDT. Microsoft confirmed that its Visual Studio Marketplace and the Claude Code npm distribution were unaffected.

Hackers Distribute Malicious Claude Code Extension

Anthropic said its systems were not compromised and that it did not develop the malicious packages. The malicious function executes when the extension module loads, before normal initialization.

Using Node.js APIs, it collects the hostname, username, operating system, architecture, home and working directories, and global Git email. Errors are silently suppressed, helping the legitimate extension continue operating without obvious disruption.

The loader also identifies up to forty environment-variable names containing credential-related strings, including KEY, TOKEN, SECRET, PASS, AWS, and GCP.

A delayed callback attempts to report those names, not their values. Consequently, this collection does not independently demonstrate theft of the underlying secrets.

To prepare access, the malware checks authorized_keys for the svc-telemetry marker and appends an embedded Ed25519 public key when absent. A separate private key authenticates the outbound tunnel, initially from a hidden temporary file whose name begins with .stk_.

The SSH arguments -N -R '*:0:localhost:22' request server-assigned remote port-forwarding connections to the workstation’s local SSH service.

The loader disables ordinary host-key verification and uses retry loops to reconnect. Microsoft identified 134.209.82[.]225 as the configured SSH and HTTP destination.

On macOS, persistence uses ~/Library/LaunchAgents/com.apple.sysmond.plist. Linux receives a user-crontab @reboot entry referencing ~/.config/.smt.

Both platforms use ~/.config/.smtk for the tunnel identity. Windows attempts a SysMon scheduled task requesting SYSTEM execution, with a Startup-folder sysmon.cmd fallback.

These files and startup entries reside outside the extension directory, meaning uninstalling or updating the extension does not remove them.

However, attempted execution does not prove successful intrusion: host privileges, local SSH settings, and attacker-server configuration determine whether remote access works. Cursor reported that errors and administrator-permission requirements blocked SSH access on most macOS and Windows hosts.

Defenders should identify affected installations, preserve extension packages and host artifacts, and isolate devices showing loader execution or backdoor installation.

Investigators should correlate network connections with unauthorized keys, tunnel processes, startup actions, and authentication events. Confirmed malicious artifacts require separate removal while preserving legitimate SSH configuration.

Rotate credentials or revoke sessions when exposure is indicated. Approved-publisher restrictions and installation cooldowns can reduce future exposure to malicious extension releases across managed developer environments without relying solely on cleanup.

Indicators of compromise (IOCs)

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team