How a Fake Claude Code Extension Turned Developer Workstations Into SSH Backdoor Relays
Executive Summary
On October 29, 2026, a tampered version of the Anthropic Claude Code extension (versions 2.1.312 and 2.1.313) was served via the Cursor IDE extension marketplace for approximately eleven hours. The injected JavaScript loader executed silently at module load time, collected host reconnaissance data, appended an attacker-controlled SSH public key, enabled the local SSH service, established a reverse SSH tunnel to a remote command-and-control server at 134.209.82.225, and installed platform-specific persistence mechanisms on macOS, Linux, and Windows. Microsoft Threat Intelligence confirmed that neither the Visual Studio Marketplace, npm, nor Anthropic's own systems were compromised; the attack was isolated to the Cursor marketplace supply chain.
This incident illustrates how AI-branded developer tooling has become a high-value supply-chain target. As agentic AI coding assistants proliferate across enterprise developer workstations, adversaries are increasingly weaponizing trusted extension ecosystems to implant persistent backdoors, underscoring the urgency of extension vetting, egress controls, and zero-trust segmentation in developer environments.
Why This Matters Now
AI coding assistants such as Claude Code and Cursor are now standard in enterprise developer workflows, making their extension marketplaces attractive, low-friction supply-chain entry points. With auto-update features enabled by default and millions of installs occurring daily, a malicious extension can propagate a persistent SSH backdoor across an organization's developer fleet within hours before any signature or policy control fires—demanding immediate extension governance and network egress enforcement.
Attack Path Analysis
An attacker injected malicious JavaScript into a trojanized Claude Code-branded VS Code extension distributed via the Cursor marketplace, which executed automatically on installation and performed host reconnaissance, planted an attacker-controlled SSH key, and established a persistent reverse SSH tunnel to an attacker-controlled server. The backdoor configured platform-specific startup persistence, beaconed host details including environment variable names indicative of cloud credentials, and maintained covert command-and-control via outbound SSH tunneling, with ultimate impact being persistent unauthorized remote access to developer workstations and potential downstream supply-chain compromise.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
A tampered version of the anthropic.claude-code extension (versions 2.1.312 and 2.1.313) was published to the Cursor extension marketplace. The injected JavaScript loader executed automatically when the extension module loaded in a developer's IDE, requiring no user interaction beyond installation or auto-update. This represents a classic software supply-chain attack targeting a trusted distribution channel.
MITRE ATT&CK® Techniques
Supply Chain Compromise: Compromise Software Dependencies and Development Tools
Command and Scripting Interpreter: JavaScript
Account Manipulation: SSH Authorized Keys
Scheduled Task/Job: Cron
Scheduled Task/Job: Scheduled Task
Masquerading: Masquerade Task or Service
Protocol Tunneling
System Information Discovery
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev. 5 – Supply Chain Risk Management and Software Integrity Verification
Control ID: SA-12 / SR-3
PCI DSS 4.0 – Software Inventory and Authorized Software Management
Control ID: Requirement 6.3.2 / 12.3.4
CISA Zero Trust Maturity Model 2.0 – Application Integrity and Device Trust Validation
Control ID: Application Pillar – Application Access / Device Pillar – Device Compliance
NIS2 Directive – Supply Chain Security and Incident Handling
Control ID: Article 21(2)(d) / Article 21(2)(h)
DORA (Digital Operational Resilience Act) – Third-Party ICT Risk and Threat Detection
Control ID: Article 28 – ICT Third-Party Risk / Article 10 – Detection Capabilities
NYDFS 23 NYCRR 500 – Application Security Training and Incident Response Planning
Control ID: Section 500.14 / Section 500.16
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Supply-chain attack via trojanized Cursor IDE extension exposes software engineers to persistent SSH backdoors, lateral movement risk, and credential exfiltration targeting API keys, tokens, and cloud secrets in development environments.
Information Technology/IT
IT organizations face critical SSH authorization compromise, reverse tunnel persistence, and multi-platform backdoor deployment requiring Zero Trust segmentation and egress policy enforcement across hybrid cloud infrastructure.
Computer/Network Security
Security teams are directly targeted through developer toolchain infiltration, undermining trust boundaries and demanding immediate anomaly detection, east-west traffic controls, and NIST.800-53 incident response protocol activation.
Financial Services
Environment variable harvesting targeting AWS, GCP, KEY, and TOKEN secrets creates acute PCI.4.0 and ZTMM.Data compliance exposure, enabling credential theft from financial platforms via compromised developer workstations.
Sources
- Inside a malicious Claude Code-branded extension and its persistent SSH backdoorhttps://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/Verified
- Security notice: malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplacehttps://www.cursor.com/securityVerified
- MITRE ATT&CK T1572 - Protocol Tunnelinghttps://attack.mitre.org/techniques/T1572/Verified
- MITRE ATT&CK T1098.004 - SSH Authorized Keyshttps://attack.mitre.org/techniques/T1098/004/Verified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- NVD - National Vulnerability Databasehttps://nvd.nist.gov/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
This supply-chain attack leveraged a trojanized IDE extension to establish persistent SSH backdoors and exfiltrate cloud credential indicators from developer workstations, making Aviatrix Zero Trust CNSF directly relevant through its ability to constrain outbound tunneling paths and limit lateral reachability from compromised developer environments into cloud infrastructure. By enforcing segmented, identity-aware network policies, CNSF would likely reduce the attacker's ability to pivot from a compromised workstation into downstream cloud environments and internal services.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Workload-level network segmentation enforced across the developer environment could likely limit the blast radius of the compromised IDE process, constraining its ability to reach cloud control planes or internal services even after initial code execution takes place.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation policies scoped to developer workstation identities would likely constrain the effective reach of elevated SSH access, reducing the attacker's ability to use newly acquired SYSTEM-level or SSH-authenticated privileges to connect outbound or laterally to adjacent cloud-connected resources.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement across cloud and hybrid network segments would likely reduce the attacker's ability to move laterally from a compromised developer workstation into cloud VPCs, internal services, or CI/CD infrastructure, even when using valid stolen credentials or legitimate SSH paths.
Control: Multicloud Visibility & Control
Mitigation: Centralized multicloud visibility and outbound traffic control policies would likely surface and constrain the reverse SSH tunnel to an uncategorized external IP, reducing the attacker's ability to maintain reliable command-and-control connectivity from developer workstations across cloud-managed egress paths.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security policy enforcement restricting outbound HTTP traffic to non-approved destinations would likely constrain the beacon's ability to reach the attacker's collection endpoint, reducing the volume of host and credential-indicator data successfully transmitted outside the environment.
With segmentation, egress enforcement, and east-west controls in place across prior stages, the attacker's residual access would likely be scoped to the compromised workstation itself, with cloud infrastructure, internal services, and CI/CD pipelines remaining less reachable even if the SSH backdoor persists on the host.
Impact at a Glance
Affected Business Functions
- Software Development and Engineering Workstations
- Source Code and Intellectual Property Repositories
- Cloud and Infrastructure Credential Management
- Developer Identity and Authentication Systems
Estimated downtime: 3 days
Estimated loss: N/A
The malicious extension targeted software developers and engineers using the Cursor IDE. Exposed data categories include: environment variable names referencing sensitive categories such as API keys, tokens, secrets, passwords, AWS and GCP credentials (variable names collected, not confirmed values exfiltrated); host reconnaissance data including hostname, username, OS, architecture, home directory, working directory, and global Git email. Persistent SSH backdoor installation could enable ongoing unauthorized access to developer workstations, potentially exposing source code, proprietary algorithms, cloud infrastructure credentials, and CI/CD pipeline secrets. The incident was live for approximately 11 hours on October 29, 2026. Cursor reported that SSH access was blocked on most macOS and Windows hosts due to permission requirements, but key planting and persistence artifacts may still have been written. The full scope of credential or code exposure is unconfirmed at time of analysis.
Recommended Actions
Key Takeaways & Next Steps
- • Apply Zero Trust Segmentation and East-West Traffic Security controls to restrict developer workstation outbound SSH connections to only approved, known-good destinations — an identity-based egress policy enforced at the network layer would have blocked the reverse SSH tunnel to 134.209.82.225 before the C2 channel was established.
- • Deploy Egress Security and Policy Enforcement (FQDN/IP-based egress filtering) to prevent unauthorized outbound connections from developer endpoints to attacker-controlled infrastructure, blocking both the reverse SSH tunnel on port 22 and the HTTP beacon to port 8099 on unapproved external IPs.
- • Leverage Multicloud Visibility and Control to baseline and continuously monitor developer workstation outbound traffic patterns — anomalous SSH tunneling to dynamic cloud IPs, autossh retry loops, and HTTP beaconing to non-corporate destinations should generate high-priority alerts for immediate investigation.
- • Use Cloud Firewall (ACF) and Inline IPS (Suricata) capabilities to inspect and block known malicious payload signatures associated with reverse SSH tunnel establishment, trojanized extension artifacts, and unauthorized SSH key injection patterns before they reach persistence stages.
- • Enforce Cloud Native Security Fabric (CNSF) inline policy controls across developer toolchain environments to detect and block agentic or extension-based code execution that attempts to modify SSH authorization files, write startup persistence artifacts, or spawn outbound tunnel processes — treating IDE extension loading as an untrusted execution context requiring runtime inspection.
