Cursor 插件市场惊现恶意 Claude Code 扩展：伪造 Anthropic 官方并试图植入 SSH 后门

今天，我们发现了一起涉及 Cursor VS Code 扩展市场中特定扩展的安全事件：针对 Windows 和 MacOS 的 Anthropic.claude-code 2.1.312 和 2.1.313 版本。这些恶意版本的扩展并非由 Anthropic 开发。该事件不影响从 cursor.com/marketplace 下载的其他扩展、Grok Bot、Grok 或我们其他的 SpaceXSI 产品。

发生了什么

在今天太平洋时间约凌晨 2:27 至下午 1:35 之间，一个被恶意篡改的 Anthropic Claude Code 扩展版本出现在 Cursor VS Code 扩展市场中。该扩展会运行恶意代码，试图安装持久化的 SSH 后门。具体而言，它会：

• 收集并上报主机与用户信息：主机名、用户名、操作系统、系统架构、用户主目录路径、环境变量名称、工作目录、配置的 Git 邮箱以及公网 IP。
• 尝试将攻击者控制的 SSH 密钥追加至 authorized_keys，启用本地 SSH 服务，并打开反向 SSH 隧道。除非在极少数以管理员权限启动 Cursor 的异常情况下，否则由于恶意代码本身的错误，此步骤均会执行失败。
• 尝试通过 LaunchAgent（macOS）或计划任务（尝试在 Windows 上以 SYSTEM 权限运行，并在失败时回退至启动脚本）使反向 SSH 隧道持久化。后台脚本大约每 60 秒重试一次连接隧道。

注意：攻击者服务器已不再运作。

• 我们已与托管该服务器的云服务商合作将其关停，因此反向 Shell 和主机信息 POST 请求已无法生效。
• 上述排查结论仅针对已被识别的软件包。我们尚无证据表明该扩展的其他版本或官方分发渠道受到影响。
• 此外，开启本地 SSH 服务需要管理员权限，而恶意扩展在绝大多数 macOS 和 Windows 主机上均不具备该权限。在这些主机上，该步骤会执行失败，攻击者无法通过隧道登录。不过，该扩展仍添加了攻击者的 SSH 密钥、安装了持久化项，并将主机详情发送给了攻击者。无论如何，请务必遵循以下处置步骤。

我们的应对措施

• 发现后立即从 Cursor VS Code 扩展市场下架了恶意版本，并阻止了后续分发。出于审慎考虑，我们随后对整个市场进行了全面停机维护。
• 我们对访问权限进行了审计，确认没有其他扩展被篡改。
• 我们轮换了密钥，重新构建了市场，并已将其恢复上线。
• 我们与云托管服务商合作下线了恶意服务器，通过阻断与该服务器的连接瓦解了攻击链路。

您应该采取的措施

如果您在 2026 年 10 月 29 日太平洋时间凌晨 2:27 至下午 1:35 之间，在 macOS 或 Windows 上从 Cursor VS Code 扩展市场安装或更新了 Anthropic.claude-code 2.1.312 或 2.1.313 版本：

1. 运行下附脚本，验证自身是否受到影响（见下文）。
2. 在终端、网络及扩展安装遥测数据中检索下列失陷指标（IoC）。
3. 隔离已显示出 Payload 执行或后门安装迹象的主机。
4. 清理未授权的 SSH 密钥、持久化机制和运行中的隧道进程，并评估是否需要重装主机系统。仅卸载扩展可能并不足够 —— 该 Payload 会释放独立运行的持久化脚本并在后台持续运行。
5. 在受信任的系统上，轮换受影响主机可访问的所有凭证和会话。有限的环境变量窃取并不能排除攻击者后续通过后门进行更深层次凭证访问的可能性。

检查您是否受到影响

该恶意扩展会将带有 svc-telemetry 标签的攻击者公钥追加到您的 SSH 授权密钥列表中。检查方法如下：

在 macOS 上，运行：

bash grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

在 Windows 上，在 PowerShell 中运行：

powershell $files = "$HOME.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ } if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }

如果找到了该密钥，说明您的机器已受影响。请遵循上述第 3 至第 5 步，并运行适用于您操作系统的处置修复脚本。

这些脚本会删除恶意扩展、清除持久化机制、终止正在运行的隧道进程，并移除攻击者的 SSH 密钥。如果有任何残留，脚本将以非零状态退出。

在 macOS 上，下载 remediate-macos.sh，在保存脚本的目录下以受影响用户身份运行（不要以 root 身份运行）：

在 Windows 上，下载 remediate-windows.ps1，以管理员身份运行打开 PowerShell，并在保存脚本的目录下执行：

powershell powershell -ExecutionPolicy Bypass -File .\remediate-windows.ps1

失陷指标（IoC）

软件包版本 2.1.312

• 修改后的 VSIX SHA-256 (darwin-arm64)：fcbb327e38e61c4fec795e0d0591f52cd1014b813d20a5912104953c3a17c364 (MD5 e0d64d53e802a0217ba6f0e656ed2f20)
• 修改后的 VSIX SHA-256 (win32-x64)：3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081 (MD5 bd3b71ddf3d0cc3af76249afd2c0eda1)

软件包版本 2.1.313

• 修改后的 VSIX SHA-256 (darwin-arm64)：80402fdcad8799285fd93044976973ca000da7995fb93363f819bb8e4f84ee6c (MD5 34e491161e056c9b899a79b602ac73b9)
• 修改后的 VSIX SHA-256 (win32-x64)：6786ec90cbd45949695bd7805c9fbb26cfc91bc5fc897de0183d9bcb9cb21731 (MD5 7838a3be2ca0ff08c1bdb160ef516d39)

载荷（Payload）

• 被篡改的代码：扩展目录中 Darwin 和 Windows 的 2.1.312 与 2.1.313 版本 package 内的 extension.js 包含 134[.]209[.]82[.]225 及 svc-telemetry
• SHA-256: ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15
• MD5: f49bcd657ef1e626e85ce858958c1769

网络指标

• 攻击者端点：134[.]209[.]82[.]225
• 反向 SSH：tunnel@134[.]209[.]82[.]225, TCP 22
• 外部心跳信标：hxxp://134[.]209[.]82[.]225:8099/beacon (HTTP POST)
• 本地心跳尝试：127[.]0[.]0[.]1:8099/beacon (HTTP POST, 本地环回)
• 针对 ifconfig[.]me / api[.]ipify[.]org 的公网 IP 查询 —— 属于合法服务；单纯访问并不构成失陷指标

SSH 指标

• 未授权公钥：ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDdvylCEJ/k2TpezcTfedrkHyFSK9IZ3vmP6vhY4Ss0P svc-telemetry
• 未授权公钥指纹：SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk
• 反向隧道密钥指纹：SHA256:KOAU57+ZG6u3MG4WwzPzPX2O5YEe9qdOC1Bl+6MVyDQ
• 密钥注释：svc-telemetry

文件与持久化机制

• Linux / macOS：未授权密钥位于 ~/.ssh/authorized_keys；相关文件 ~/.config/.smt、~/.config/.smtk
• Linux：/tmp/.stk_<10 hex>；计划任务 cron @reboot /bin/sh "<HOME>/.config/.smt"
• macOS：$TMPDIR/.stk_<10 hex>；~/Library/LaunchAgents/com.apple.sysmond.plist (标签为 com.apple.sysmond)
• Windows：%USERPROFILE%\.ssh\authorized_keys、%USERPROFILE%\.config\smt.cmd、%USERPROFILE%\.config\smtk、%TEMP%\.stk_<10 hex>；计划任务 SysMon（尝试以 SYSTEM 身份运行）；回退脚本 %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd

进程 / 命令行

• ssh -N -R '*:0:localhost:22', autossh -M 0
• SSH 选项：StrictHostKeyChecking=no、UserKnownHostsFile=/dev/null、ServerAliveInterval=30、ServerAliveCountMax=3、ExitOnForwardFailure=yes、IdentitiesOnly=yes
• schtasks /create /tn SysMon
• systemsetup -setremotelogin on
• Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0

如有其他疑问，请联系 security@cursor.com。

更新： 2026 年 10 月 30 日太平洋时间上午 11:30：我们更新了失陷指标（IoC）并明确了受影响版本。

Today we identified a security incident involving a specific extension in the Cursor VS Code Extension Marketplace: Anthropic.claude-code version 2.1.312 and 2.1.313 for Windows and MacOS. These malicious versions of the extension were not developed by Anthropic. This does not impact other extensions downloaded from the cursor.com/marketplace, Grok Bot, Grok or our other SpaceXSI products.

#What happened

Between about 2:27am PT and 1:35pm PT today, a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code Extension Marketplace. The extension runs malicious code that attempts to install a persistent SSH backdoor. Specifically, it:

• Collects and reports host and user information: hostname, username, OS, architecture, home directory path, environment variable names, working directories, configured Git email, and public IP.
• Attempts to add an attacker-controlled SSH key to authorized_keys, enable the local SSH service, and open a reverse SSH tunnel. Outside of highly unusual circumstances where Cursor was started with administrator privileges, due to errors in the malicious code, this step would fail.
• Attempts to make the reverse SSH tunnel persistent via a LaunchAgent (macOS), or a scheduled task that attempts to run as SYSTEM with a Startup-script fallback (Windows). Background scripts retry the tunnel roughly every 60 seconds.

Note: The attacker server no longer functions.

• We worked with the cloud provider that was hosting it to take it offline, so the reverse shell and host detail POST are not functional.
• These findings concern the identified package. We have no evidence that other versions of the extension or the official distribution are affected.
• Additionally, turning on the local SSH service requires admin rights, which the malicious extension does not have on most macOS and Windows hosts. On those hosts the step fails and the attacker could not have logged in through the tunnel. The extension added the attacker’s SSH key, installed persistence, and sent host details to the attacker. Follow the remediation steps below regardless.

#What we did

• Removed the malicious version from the Cursor VS Code Extension Marketplace immediately upon detection and blocked further distribution. We followed with a full shut down of the marketplace out of an abundance of caution.
• We audited access and confirmed no other extensions were tampered with.
• We rotated our keys, rebuilt the marketplace, and brought it back online.
• We worked with the hosting provider to take the malicious server offline, disrupting the attack by blocking the connection to that server.

#What you should do

If you installed or updated to Anthropic.claude-code 2.1.312 or 2.1.313 from the Cursor VS Code Extension Marketplace on macOS or Windows between 2:27am PT and 1:35pm PT on October 29, 2026:

1. Run the attached script to validate if you are impacted (see below).
2. Search across endpoint, network, and extension-installation telemetry for the indicators below.
3. Isolate hosts showing evidence of payload execution or backdoor installation.
4. Remove the unauthorized SSH key, persistence mechanisms, and running tunnel processes, and assess whether the host should be rebuilt. Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running.
5. Rotate credentials and sessions accessible from affected hosts, from a trusted system. The limited env-var collection does not rule out later credential access over the backdoor.

#Check whether you are impacted

The malicious extension appends the attacker's public key, labeled svc-telemetry, to your SSH authorized keys. To check for it:

On macOS, run:

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

On Windows, run in PowerShell:

$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }

If the key is found, your machine is impacted. Follow steps 3 to 5 above, and run the remediation script for your platform below.

These scripts remove the malicious extension, the persistence mechanisms, the running tunnel processes, and the attacker's SSH key. They exit with a non-zero status if anything remains.

On macOS, download remediate-macos.sh and run it as the affected user, not as root, from the folder you saved it to:

On Windows, download remediate-windows.ps1 and run it from PowerShell opened with Run as Administrator , in the folder you saved it to:

powershell -ExecutionPolicy Bypass -File .\remediate-windows.ps1

#Indicators of compromise

#Package version 2.1.312

• Modified VSIX SHA-256 (darwin-arm64): fcbb327e38e61c4fec795e0d0591f52cd1014b813d20a5912104953c3a17c364 (MD5 e0d64d53e802a0217ba6f0e656ed2f20)
• Modified VSIX SHA-256 (win32-x64): 3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081 (MD5 bd3b71ddf3d0cc3af76249afd2c0eda1)

#Package version 2.1.313

• Modified VSIX SHA-256 (darwin-arm64): 80402fdcad8799285fd93044976973ca000da7995fb93363f819bb8e4f84ee6c (MD5 34e491161e056c9b899a79b602ac73b9)
• Modified VSIX SHA-256 (win32-x64): 6786ec90cbd45949695bd7805c9fbb26cfc91bc5fc897de0183d9bcb9cb21731 (MD5 7838a3be2ca0ff08c1bdb160ef516d39)

#Payload

• Modified code: extension.js in package versions 2.1.312 and 2.1.313 for both Darwin and Windows in the extension folder contains 134[.]209[.]82[.]225 and svc-telemetry
• SHA-256: ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15
• MD5: f49bcd657ef1e626e85ce858958c1769

#Network

• Attacker endpoint: 134[.]209[.]82[.]225
• Reverse SSH: tunnel@134[.]209[.]82[.]225, TCP 22
• External beacon: hxxp://134[.]209[.]82[.]225:8099/beacon (HTTP POST)
• Local beacon attempt: 127[.]0[.]0[.]1:8099/beacon (HTTP POST, loopback)
• Public IP lookups to ifconfig[.]me / api[.]ipify[.]org — legitimate services; access alone is not an indicator

#SSH

• Unauthorized public key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDdvylCEJ/k2TpezcTfedrkHyFSK9IZ3vmP6vhY4Ss0P svc-telemetry
• Unauthorized key fingerprint: SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk
• Reverse-tunnel key fingerprint: SHA256:KOAU57+ZG6u3MG4WwzPzPX2O5YEe9qdOC1Bl+6MVyDQ
• Key comment: svc-telemetry

#Files and persistence

• Linux / macOS: unauthorized key in ~/.ssh/authorized_keys; ~/.config/.smt, ~/.config/.smtk
• Linux: /tmp/.stk_<10 hex>; cron @reboot /bin/sh "<HOME>/.config/.smt"
• macOS: $TMPDIR/.stk_<10 hex>; ~/Library/LaunchAgents/com.apple.sysmond.plist (label com.apple.sysmond)
• Windows: %USERPROFILE%\.ssh\authorized_keys, %USERPROFILE%\.config\smt.cmd, %USERPROFILE%\.config\smtk, %TEMP%\.stk_<10 hex>; scheduled task SysMon (attempts to run as SYSTEM); fallback %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd

#Process / command-line

• ssh -N -R '*:0:localhost:22', autossh -M 0
• SSH options: StrictHostKeyChecking=no, UserKnownHostsFile=/dev/null, ServerAliveInterval=30, ServerAliveCountMax=3, ExitOnForwardFailure=yes, IdentitiesOnly=yes
• schtasks /create /tn SysMon
• systemsetup -setremotelogin on
• Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0

If you have further questions, reach out to security@cursor.com.

Update: Oct 30, 2026, 11:30 am PT: We updated the IOCs and clarified affected versions.