A tampered version of Anthropic's Claude Code extension for Visual Studio Code, sitting on the Cursor extension marketplace, installed a remote access backdoor on developer machines, security researchers said. The malicious build, version 2.1.313, gave attackers hands-on and automated access to infected laptops and desktops in what amounts to a supply chain attack.
Phorion, a security firm, was the first to notice the malicious activity on endpoints and published an advisory. Kevin Beaumont, a security researcher who has been tracking the incident, later published Microsoft Defender for Endpoint hunting queries that organizations can use to look for the malicious version.
How many developer systems were affected by the tampered Claude Code extension?
Cursor said the extension auto-updated inside its editor to the tampered version, and that around 5,000 developer systems were impacted. In its own statement, Anthropic said: “A malicious actor used access to Cursor’s marketplace to publish a tampered extension targeting Cursor’s users, we were not involved with building, publishing, or hosting this.”
Beaumont took issue with how Cursor described the incident. Cursor’s blog said the malicious version “was not developed by Anthropic.” Beaumont pointed out that the extension was uploaded under Anthropic’s verified account, and argued that the word “developed” was doing a lot of work in that sentence. He noted that Anthropic did not write the backdoor, but that the incident was still a supply chain attack that reached Anthropic users.
What did the malicious Claude Code extension do on infected machines?
According to Beaumont’s analysis, the extension ran code that tried to install a persistent SSH backdoor. It collected host and user information, including hostname, username, operating system, architecture, home directory path, environment variable names, working directories, the configured Git email and the public IP address. It then attempted to add an attacker-controlled key to the system’s authorized keys, enable the local SSH service and open a reverse SSH tunnel. Beaumont wrote that, outside of unusual circumstances in which Cursor was started with administrator privileges, that step would fail because of errors in the malicious code.
Even so, the code tried to make the tunnel persistent. On macOS it used a LaunchAgent. On Windows it attempted to create a scheduled task that would run as SYSTEM, with a startup script as a fallback. Background scripts retried the tunnel roughly every 60 seconds. The code also sent host details and backdoor status to an external server via HTTP POST.
Does updating to version 2.1.314 remove the backdoor?
Anthropic later replaced version 2.1.313 with version 2.1.314. Beaumont said the new version appears to remove the backdoor, but he was not certain it contains no malicious code. He also said the update does not remove the SSH backdoor from systems already infected, or the reconnaissance activity that preceded it.
The malicious version has disappeared from several marketplaces. Beaumont reported that 2.1.313 was missing from OpenVSX, the Visual Studio Marketplace and Cursor. He also said the malicious version was silently removed, and that Anthropic had not informed customers. Beaumont wrote that Anthropic had not told customers about the breach.
Developers who installed the extension are the ones most at risk. Beaumont published network indicators of compromise, including file hashes for the Mac and Windows packages, a reverse tunnel address and a command-and-control endpoint on port 8099. He also cautioned that public IP lookup services such as ifconfig.me and ipify.org are legitimate, and that access to them alone is not an indicator of compromise.
Este artigo foi escrito com a assistência de IA.
News Factory APP - notícias agênticas para impulsionar seu SEO e AEO.