{"id":3886,"date":"2026-10-30T10:59:13","date_gmt":"2026-10-30T10:59:13","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3886"},"modified":"2026-10-30T10:59:13","modified_gmt":"2026-10-30T10:59:13","slug":"official-claude-code-vs-code-extension-compromised-to-install-persistent-ssh-backdoor","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3886","title":{"rendered":"Official Claude Code VS Code Extension Compromised to Install Persistent SSH Backdoor"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Oct 30, 2026<\/span><\/span>Malware \/ Artificial Intelligence<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Cybersecurity researchers have disclosed<\/a> that the official Anthropic Claude Code extension was compromised on the Cursor Marketplace to install a persistent SSH backdoor on infected hosts.<\/p>\n

The issue has since been traced to the compromise of the Cursor Marketplace, prompting the AI coding platform Cursor to briefly take down the service to remove the malware.<\/p>\n

\u00abWe identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users,\u00bb Cursor said<\/a>. \u00abThis malicious version of the extension was not developed by Anthropic. It does not impact other extensions downloaded from the cursor[.]com\/marketplace, Grok Bot, Grok, or our other SpaceXSI product<\/p>\n

\u00abThe package identifies itself as anthropic.claude-code version 2.1.313, but its main JavaScript bundle contains a malicious 66-line loader inserted before the legitimate extension code,\u00bb Jenn Gile, co-founder of OpenSourceMalware, said in a statement shared with The Hacker News.<\/p>\n

As of October 30, 2026, the malicious version has been removed, and Anthropic has published version 2.1.314<\/a> to both Open VSX and Microsoft VS Code Marketplace.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The extension is designed to activate after VS Code startup and when its webview opens, then proceeds to add an attacker-controlled key to the user’s \u00ab~\/.ssh\/authorized_keys\u00bb file. The key is labeled \u00absvc-telemetry\u00bb in an attempt to make it appear harmless.<\/p>\n

<\/p>\n

Subsequently, it attempts to make the victim reachable through SSH across Windows, Linux, and macOS, establishes a reverse tunnel to \u00ab134.209.82[.]225<\/a>,\u00bb installs platform-specific persistence in the form of a scheduled task, crontab, and LaunchAgent, and transmits host reconnaissance data to \u00ab134.209.82[.]225:8099\/beacon\u00bb on port 8099 over an unencrypted HTTP request.<\/p>\n

\u00abTurning on the local SSH service requires admin rights, which the malicious extension does not have on most macOS and Windows hosts,\u00bb the SpaceXAI-owned company said<\/a> in its own analysis of the incident.<\/p>\n

\u00abOn those hosts the step fails and the attacker could not have logged in through the tunnel. The extension still adds the attacker’s SSH key, installs persistence, and sends host details to the attacker. Follow the remediation steps below regardless.\u00bb<\/p>\n

\"\"<\/a><\/div>\n

The collected data includes –<\/p>\n