Malicious Claude Code extensions install persistent SSH backdoors
Original title: Malicious Claude Code Extensions in Cursor Marketplace Install Persistent SSH Backdoors on Windows and macOS
Cursor removes Anthropic.claude-code extensions 2.1.312 and 2.1.313 after they create SSH backdoors on developer systems.
Modified Claude Code extensions distributed via Cursor marketplace attempted to collect host information and establish reverse SSH tunnels to an attacker server. They installed persistence via LaunchAgent on macOS and scheduled tasks on Windows. Cursor removed the packages, temporarily disabled the marketplace, and coordinated with the hosting provider to disable the attacker's server.
Unconfirmed: Cursor stated no evidence that other extension versions or the official distribution were affected.
- Packages 2.1.312 and 2.1.313 were available October 29, 2026.
- Persistence used LaunchAgent com.apple.sysmond.plist and Windows scheduled task SysMon.
- Reverse tunnel targeted 134.209.82.225 on port 22.
- Cursor reported unauthorized key insertion and host data transmission.
Impact: Persistent SSH backdoor installation on developer systems
- 1.Remove malicious extensions from Cursor marketplace
- 2.Check for unauthorized SSH keys
- 3.Monitor for reverse SSH tunnels
- AI models
- Claude
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 134.209.82.225 | ble the local SSH service and establish a reverse tunnel to 134[.]209[.]82[.]225 over TCP port 22. HThe attackertransmitted thost reco |
| sha256 | 6786ec90cbd45949695bd7805c9fbb26cfc91bc5fc897de0183d9bcb9cb21731 | e8ecc3ab6bf15 Modified payload Windows 2.1.313 VSIX SHA-256 6786ec90cbd45949695bd7805c9fbb26cfc91bc5fc897de0183d9bcb9cb21731 Malicious Windows package macOS LaunchAgent ~/Library/Launc |
| sha256 | ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15 | Ee9qdOC1Bl+6MVyDQ Tunnel authentication key Payload SHA-256 ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15 Modified payload Windows 2.1.313 VSIX SHA-256 6786ec90cbd45 |
| url | http://134.209.82.225:8099/beacon | 134[.]209[.]82[.]225:22 Outbound SSH tunnel External beacon hxxp://134[.]209[.]82[.]225:8099/beacon HTTP POST reconnaissance Loopback beacon 127[.]0[.]0[ |
From the original article
3 min read at gbhackers.com
Malicious Claude Code extensions distributed through Cursor’s VS Code The Extension Marketplace tried to create persistent SSH backdoors on Windows and macOS developer systems. The affected packages were the Anthropic. claude-code versions 2.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.