Backdoor Found in Claude Code Extension on Cursor Marketplace
October 31, 2026, Noon
Security firm Phorion disclosed today that a compromised version of the official Claude Code for VS Code extension on the Cursor Marketplace contained a persistent SSH backdoor. The affected versions, 2.1.312 and 2.1.313, have been removed from the marketplace [1].
The extension runs with the permissions of the IDE and the user, which means the backdoor had immediate access to local files, source code, and developer tooling as soon as Node loaded the file. The user did not need to interact with the extension for the payload to fire [1].
How It Worked
The injected code was prepended to the minified extension bundle as an immediately invoked function expression. It executed before the extension's normal activate callback even ran. From there, it staged a four-phase attack [1]:
Stage 1: SSH key planting. The payload created ~/.ssh if needed and appended an attacker-controlled Ed25519 public key to authorized_keys. The key used the comment svc-telemetry. With the key in place, anyone holding the matching private key could authenticate as that user, provided SSH was running [1].
Stage 2: Reverse SSH tunnel. The script set up an outbound SSH connection to an attacker-controlled server at 134.209.82[.]225 using an embedded private key. The tunnel used remote port forwarding (-R *:0:localhost:22), asking the attacker's server to dynamically allocate a port and forward traffic back to the victim's local SSH daemon. The operator could then connect through that port and get a full interactive shell [1].
Stage 3: Persistence. On macOS, a LaunchAgent disguised as com.apple.sysmond.plist ran at login with KeepAlive enabled. On Linux, the script added an @reboot crontab entry. On Windows, it attempted a scheduled task running as SYSTEM, falling back to a Startup folder script. The tunnel stayed up even after the user closed their IDE [1].
Stage 4: Reconnaissance beacon. The script collected hostname, username, OS platform, architecture, home directory, and working directory, then sent a one-off beacon to the attacker's server [1].
A Bug That Helped macOS Users
The macOS SSH enablement logic had a bug that accidentally reduced impact. The script checked Remote Login status with systemsetup -getremotelogin without elevation. On macOS, that command requires administrator privileges and prints an error to stdout instead of returning "Off." Because the malware only tried to enable SSH if the output matched "Off," it skipped the enablement step entirely on standard user accounts [1].
This means that on Macs where Remote Login was already off, the inbound SSH path was broken. The outbound tunnel still connected, but traffic forwarded back through it hit a closed port 22. Of course, this is not something to rely on as a defense. If SSH was already enabled or turned on later, the backdoor was ready [1].
What to Check
If you used Claude Code for VSCode versions 2.1.312 or 2.1.313 from the Cursor Marketplace, check for [1]:
- An SSH public key with comment
svc-telemetryin~/.ssh/authorized_keys - Files named
.smtor.smtkin~/.config/ - On macOS:
~/Library/LaunchAgents/com.apple.sysmond.plist - On Linux:
@rebootentries in your user crontab - On Windows: a scheduled task named "SysMon" or
sysmon.cmdin the Startup folder - Any SSH connections to
134.209.82[.]225
Cursor has removed the affected versions from its marketplace. Organizations should review their environments for use of these versions and engage incident response where discovered [1].