Trojanized Claude Code Extension Backdoored 5,000 Developer Machines via Cursor's Marketplace
Executive Summary
On October 29, 2026, a trojanized version of Anthropic's Claude Code VS Code extension (v2.1.313) was distributed through Cursor's AI-powered code editor marketplace for approximately 11 hours, exposing up to 5,000 developers to malware. The malicious extension injected a JavaScript loader that silently collected system reconnaissance data—including Git email, hostname, and public IP—and attempted to install persistent SSH backdoors via macOS LaunchAgents or Windows scheduled tasks. Coding errors in the malware's SSH setup routines limited attacker access, but reconnaissance data was still transmitted to a remote server at 134.209.82[.]225. Cursor removed the extension, shut down its marketplace for auditing, and worked with the hosting provider to take the attacker's server offline.
This incident underscores the growing threat of supply-chain attacks targeting AI-assisted developer tooling. As agentic AI tools become deeply embedded in software development workflows, adversaries are increasingly weaponizing trusted extension marketplaces to compromise developer endpoints at scale—making extension integrity verification and runtime behavioral monitoring critical priorities for security teams in 2026.
Why This Matters Now
AI coding assistants like Claude Code and Cursor have rapidly become standard developer infrastructure, yet their extension ecosystems lack robust code-signing and provenance enforcement. This attack demonstrates that threat actors are actively targeting these high-trust, low-scrutiny distribution channels to silently backdoor thousands of developer workstations in a single campaign window—posing severe intellectual property, credential theft, and supply-chain integrity risks for any organization deploying AI-assisted development tools.
Attack Path Analysis
Attackers injected a malicious JavaScript loader into a trojanized version of Anthropic's Claude Code VS Code extension and published it to Cursor's marketplace, where it was downloaded by up to 5,000 developers before removal. Upon installation, the extension silently collected host and credential metadata, attempted to establish persistent SSH backdoors and reverse tunnels, and exfiltrated reconnaissance data to an attacker-controlled server, with the ultimate goal of enabling manual credential harvesting and long-term access to developer environments.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attackers published a trojanized version of Anthropic's Claude Code extension (v2.1.313) to Cursor's VS Code extension marketplace under Anthropic's publisher identity. A malicious JavaScript loader was prepended to the legitimate extension.js file. The extension executed the malicious code automatically upon load with no user interaction required, representing a classic software supply chain compromise targeting developer tooling.
MITRE ATT&CK® Techniques
Supply Chain Compromise: Compromise Software Dependencies and Development Tools
Command and Scripting Interpreter: JavaScript
Account Manipulation: SSH Authorized Keys
Create or Modify System Process: Launch Agent
Protocol Tunneling
System Information Discovery
Application Layer Protocol: Web Protocols
Unsecured Credentials: Container API
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev 5 – Supply Chain Risk Management and Integrity Verification
Control ID: SR-3, SR-4, SR-6
CISA Zero Trust Maturity Model 2.0 – Application Workload Integrity and Runtime Monitoring
Control ID: Applications Pillar – Application Security (Visibility & Analytics)
NIS2 Directive (EU) 2022/2555 – Supply Chain Security Measures and Incident Response Obligations
Control ID: Article 21(2)(d) – Supply Chain Security; Article 21(2)(f) – Incident Handling
PCI DSS 4.0 – Software Inventory Management and Third-Party Software Risk
Control ID: Requirement 6.3.2, Requirement 12.3.4
ISO/IEC 27001:2022 – Secure Software Supply Chain and Third-Party Component Governance
Control ID: A.8.30 – Outsourced Development; A.8.25 – Secure Development Lifecycle; A.5.23 – Information Security for Use of Cloud Services
DORA (EU) 2022/2554 – ICT Third-Party Risk and Digital Operational Resilience
Control ID: Article 28 – ICT Third-Party Risk Management; Article 45 – Intelligence Sharing
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Supply-chain attack via malicious Cursor IDE extension exposed up to 5,000 developers to SSH backdoors, exfiltrating Git credentials and environment variables, undermining NIST.800-53.SC-7 and Zero Trust segmentation controls.
Information Technology/IT
Trojanized AI coding extension planted persistent SSH reverse tunnels on developer workstations, enabling lateral movement and reconnaissance data exfiltration, threatening ZTMM.Network and PCI.4.0.4.2.1 compliance postures.
Computer/Network Security
Supply-chain compromise of an Anthropic-branded extension bypassed extension marketplace trust controls, exposing credential stores and requiring full environment rebuilds aligned to HIPAA.164.308 and NIST.CSF.PR.DS-5 remediation mandates.
Cloud Native Security Fabric (CNSF)
Agentic AI tooling weaponized as an initial compromise vector highlights critical gaps in cloud-native enforcement, shadow AI risk visibility, and ZTMM.CrossCutting.Automation controls mapped in validated_info killchain analysis.
Sources
- Malicious Claude Code extension on Cursor planted SSH backdoorshttps://www.bleepingcomputer.com/news/security/malicious-claude-code-extension-on-cursor-planted-ssh-backdoors/Verified
- Cursor Security Notice: Claude Code Extension Compromisehttps://cursor.com/blog/claude-code-extension-security-noticeVerified
- Phorion Research: Official Claude Code VSX Compromisehttp://phorion.io/blog/offical-claude-code-vsx-compromise/Verified
- OpenSourceMalware: Trojanized Claude Code Extension Plants Persistent SSH Backdoorhttp://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoorVerified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to this supply chain attack because the malware relied on unrestricted outbound connectivity and lateral reachability from developer workstations into cloud environments and CI/CD pipelines. By enforcing segmentation, controlled egress, and identity-aware access boundaries, CNSF would likely reduce the attacker's ability to pivot from compromised developer machines into connected cloud and pipeline infrastructure.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Workload-level segmentation within CNSF could likely reduce the reachability of a newly compromised developer endpoint, limiting how far the malicious loader's initial callbacks and reconnaissance attempts could propagate across cloud-connected network paths.
Control: Zero Trust Segmentation
Mitigation: Zero Trust Segmentation would likely constrain the attacker's ability to leverage any injected SSH access to reach cloud workloads or internal services, reducing the effective privilege scope even where SSH key injection itself succeeded on the local endpoint.
Control: East-West Traffic Security
Mitigation: East-west enforcement within CNSF would likely reduce the attacker's ability to pivot laterally from a compromised developer workstation toward cloud workloads, CI/CD systems, or shared pipeline infrastructure, constraining the blast radius of any credential or session material already harvested.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility and control within CNSF could likely surface anomalous outbound tunnel attempts to unexpected external IP addresses, and policy enforcement may reduce the reliability of the persistent C2 channel by constraining which outbound destinations cloud-connected developer environments are permitted to reach.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security and policy enforcement could likely reduce the volume of reconnaissance data successfully reaching the attacker's server by constraining which external destinations developer workloads are permitted to initiate outbound HTTP/S connections to from within cloud-managed network paths.
With segmentation, egress control, and east-west enforcement applied at earlier stages, the attacker's ability to convert harvested credentials and reconnaissance data into meaningful access to cloud environments, source code repositories, or CI/CD pipelines would likely be reduced, constraining the blast radius even where local endpoint compromise occurred.
Impact at a Glance
Affected Business Functions
- Software Development and CI/CD Pipelines
- Source Code Integrity and Intellectual Property
- Developer Workstation Security and Endpoint Management
- Secrets and Credential Management
Estimated downtime: 2 days
Estimated loss: N/A
Up to 5,000 developer workstations were exposed to a trojanized extension that exfiltrated reconnaissance data including usernames, hostnames, public IP addresses, Git email addresses, and names of environment variables associated with sensitive credentials such as API keys and cloud tokens. Although direct credential theft was not confirmed, the attacker's server received host details and backdoor status information. Developers with SSH already enabled on their machines were at risk of full remote code execution and persistent unauthorized access, potentially exposing source code repositories, proprietary codebases, cloud infrastructure credentials, and CI/CD pipeline secrets. The marketplace was temporarily shut down for auditing, creating secondary disruption to all Cursor extension users.
Recommended Actions
Key Takeaways & Next Steps
- • Apply CNSF Cloud Native Security Fabric controls with inline enforcement and real-time inspection to detect agentic and AI-tooling anomalies at the network layer, flagging unexpected outbound connections from developer workstations to unknown IPs such as 134.209.82[.]225 before SSH tunnels are established.
- • Enforce Egress Security and Policy Enforcement (FQDN/IP filtering) across all developer endpoints and cloud-connected workstations to block unauthorized outbound destinations and prevent reconnaissance data exfiltration and reverse tunnel establishment to attacker-controlled infrastructure.
- • Deploy Multicloud Visibility and Control with centralized traffic observability to baseline normal developer tool behavior and alert on anomalous outbound connections, repeated SSH tunnel retry patterns, and unexpected authorized_keys modifications that deviate from established workload communication profiles.
- • Implement Zero Trust Segmentation with least-privilege identity-based policies to restrict developer workstation access to only required internal resources, ensuring that even if an SSH backdoor is installed, lateral movement into CI/CD pipelines, cloud control planes, and source code repositories is contained and blocked.
- • Leverage Threat Detection and Anomaly Response capabilities to monitor for SSH key injection events, LaunchAgent or scheduled task creation by IDE extension processes, and outbound traffic to newly observed IPs, enabling rapid automated isolation of compromised developer machines before manual credential harvesting can occur.
