{"id":3888,"date":"2026-11-03T14:27:38","date_gmt":"2026-11-03T22:27:38","guid":{"rendered":"https:\/\/cyber.mag212.com\/?p=3888"},"modified":"2026-11-03T14:33:06","modified_gmt":"2026-11-03T22:33:06","slug":"malicious-claude-code-extension-cursor-how-to-check","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/malicious-claude-code-extension-cursor-how-to-check\/","title":{"rendered":"Malicious Claude Code Extension in Cursor: How to Check Your PC or Mac"},"content":{"rendered":"\n<link href=\"https:\/\/fonts.googleapis.com\/css2?family=Inter:wght@400;500;600;700;800&#038;family=Source+Serif+4:opsz,wght@8..60,400;8..60,600&#038;family=JetBrains+Mono:wght@400;500&#038;display=swap\" rel=\"stylesheet\"><style>.m212{--ink:#0e1726;--body:#2b3647;--muted:#5d6b80;--line:#e3e8ef;--paper:#ffffff;--tint:#f5f7fa;--navy:#0a1424;--navy2:#13233b;--accent:#19c39a;--accent-dk:#0e8f70;--crit:#d6363f;--warn:#b7791f;--sans:\"Inter\",system-ui,-apple-system,\"Segoe UI\",Roboto,sans-serif;--serif:\"Source Serif 4\",Georgia,\"Times New Roman\",serif;--mono:\"JetBrains Mono\",ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;background:var(--paper);color:var(--body);font-family:var(--serif);font-size:19px;line-height:1.7;-webkit-font-smoothing:antialiased;margin:0}.m212 *{box-sizing:border-box}.m212 a{color:var(--accent-dk);text-decoration:underline;text-decoration-thickness:1px;text-underline-offset:3px}.m212 a:hover{color:var(--ink)}.m212 .hero{background:radial-gradient(1200px 500px at 85% -10%,#1b3a5c 0%,transparent 60%),linear-gradient(180deg,var(--navy) 0%,var(--navy2) 100%);color:#e8eef6;padding:44px 24px 64px;border-radius:16px}.m212 .hero-inner{max-width:820px;margin:0 auto}.m212 .kicker{font-family:var(--sans);font-size:12.5px;font-weight:600;letter-spacing:.16em;text-transform:uppercase;color:var(--accent);margin:0 0 18px}.m212 .dek{font-family:var(--serif);font-size:21px;line-height:1.55;color:#c7d3e3;margin:0 0 28px;max-width:720px}.m212 .byline{font-family:var(--sans);font-size:14px;color:#9fb0c6;display:flex;flex-wrap:wrap;gap:6px 18px}.m212 .byline strong{color:#fff;font-weight:600}.m212 .tags{display:flex;flex-wrap:wrap;gap:8px;margin-top:22px}.m212 .tag{font-family:var(--sans);font-size:12px;font-weight:600;padding:5px 10px;border-radius:999px;border:1px solid #2c4566;color:#cfe0f2;background:rgba(255,255,255,.04)}.m212 .tag.crit{border-color:#7a2a31;background:rgba(214,54,63,.18);color:#ffb8bd}.m212 .facts{max-width:1080px;margin:-36px auto 0;padding:0 24px;position:relative}.m212 .facts-grid{display:grid;grid-template-columns:repeat(4,1fr);background:#fff;border:1px solid var(--line);border-radius:14px;box-shadow:0 12px 32px rgba(10,20,36,.10);overflow:hidden}.m212 .fact{padding:18px 20px;border-right:1px solid var(--line);font-family:var(--sans)}.m212 .fact:last-child{border-right:0}.m212 .fact .k{font-size:11.5px;letter-spacing:.12em;text-transform:uppercase;color:var(--muted);font-weight:600}.m212 .fact .v{font-size:22px;font-weight:800;color:var(--ink);margin-top:4px;line-height:1.2}.m212 .fact .v.crit{color:var(--crit)}.m212 .fact .s{font-size:13px;color:var(--muted);margin-top:2px;line-height:1.4}.m212 .wrap{max-width:760px;margin:0 auto;padding:48px 0 24px}.m212 p{margin:0 0 1.15em}.m212 .lede{font-size:21px;line-height:1.65;color:var(--ink)}.m212 h2{font-family:var(--sans);font-size:28px;line-height:1.25;letter-spacing:-.01em;color:var(--ink);margin:2.4em 0 .7em;font-weight:800}.m212 h2 .num{display:block;font-size:12.5px;letter-spacing:.16em;color:var(--accent-dk);font-weight:700;margin-bottom:6px}.m212 h3{font-family:var(--sans);font-size:19px;color:var(--ink);margin:1.8em 0 .5em;font-weight:700}.m212 strong{color:var(--ink)}.m212 sup.ref{font-family:var(--sans);font-size:11.5px;font-weight:600;line-height:0;margin-left:1px}.m212 sup.ref a{text-decoration:none;color:var(--accent-dk)}.m212 code{font-family:var(--mono);font-size:.82em;background:var(--tint);border:1px solid var(--line);border-radius:5px;padding:1px 6px;color:#1d2a3d}.m212 .callout{font-family:var(--sans);font-size:16px;line-height:1.6;border-radius:12px;padding:18px 22px;margin:28px 0;border:1px solid var(--line);background:var(--tint)}.m212 .callout .lbl{display:block;font-size:11.5px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;margin-bottom:6px;color:var(--muted)}.m212 .callout p:last-child{margin:0}.m212 .callout.alert{background:#fff5f5;border-color:#f3c7ca;border-left:4px solid var(--crit)}.m212 .callout.alert .lbl{color:var(--crit)}.m212 .callout.note{border-left:4px solid var(--accent)}.m212 .callout.note .lbl{color:var(--accent-dk)}.m212 .callout.caution{background:#fffaf0;border-color:#f1dfb8;border-left:4px solid var(--warn)}.m212 .callout.caution .lbl{color:var(--warn)}.m212 .takeaways{font-family:var(--sans);background:var(--navy);color:#dfe8f3;border-radius:14px;padding:24px 26px;margin:8px 0 36px}.m212 .takeaways h4{margin:0 0 12px;font-size:12px;letter-spacing:.16em;text-transform:uppercase;color:var(--accent)}.m212 .takeaways ul{margin:0;padding-left:20px;font-size:16px;line-height:1.6}.m212 .takeaways li{margin:0 0 8px}.m212 .takeaways li:last-child{margin:0}.m212 .takeaways strong{color:#fff}.m212 .tbl{overflow-x:auto;margin:24px 0 10px;border:1px solid var(--line);border-radius:12px}.m212 table{width:100%;border-collapse:collapse;font-family:var(--sans);font-size:14.5px;line-height:1.45;margin:0}.m212 th{background:var(--tint);text-align:left;font-weight:700;color:var(--ink);font-size:12px;letter-spacing:.06em;text-transform:uppercase;padding:12px 14px;border-bottom:1px solid var(--line);vertical-align:bottom}.m212 td{padding:11px 14px;border-bottom:1px solid var(--line);vertical-align:top}.m212 tr:last-child td{border-bottom:0}.m212 td.ver{font-family:var(--mono);font-size:13.5px;white-space:nowrap}.m212 td.rec{font-family:var(--mono);font-size:13.5px;font-weight:600;color:var(--accent-dk);white-space:nowrap}.m212 td.na{color:var(--muted);font-style:italic}.m212 .tbl-note{font-family:var(--sans);font-size:13.5px;color:var(--muted);margin:0 0 24px}.m212 figure{margin:32px 0;font-family:var(--sans)}.m212 .diagram{background:linear-gradient(180deg,var(--navy) 0%,var(--navy2) 100%);border-radius:14px;padding:26px 24px}.m212 .diagram .dtitle{color:#fff;font-weight:800;font-size:15px;letter-spacing:.06em;text-transform:uppercase;margin:0 0 16px}.m212 .steps{list-style:none;margin:0;padding:0;counter-reset:s}.m212 .steps li{counter-increment:s;position:relative;background:rgba(255,255,255,.05);border:1px solid #2a4262;border-radius:10px;padding:13px 16px 13px 60px;margin:0 0 22px;color:#b9c8da;font-size:14.5px;line-height:1.45}.m212 .steps li:last-child{margin-bottom:0}.m212 .steps li::before{content:counter(s,decimal-leading-zero);position:absolute;left:18px;top:13px;font-weight:800;color:var(--accent);font-size:17px}.m212 .steps li:not(:last-child)::after{content:\"\";position:absolute;left:50%;bottom:-17px;width:2px;height:12px;background:var(--accent);opacity:.7}.m212 .steps li b{display:block;color:#fff;font-size:15.5px;margin-bottom:2px}.m212 .layers{display:grid;grid-template-columns:repeat(3,1fr);gap:12px}.m212 .layer{background:rgba(255,255,255,.05);border:1px solid #2a4262;border-radius:10px;padding:14px 16px;color:#b9c8da;font-size:14px;line-height:1.5}.m212 .layer b{display:block;color:var(--accent);font-size:11.5px;letter-spacing:.14em;text-transform:uppercase;margin-bottom:4px}.m212 .layer i{display:block;font-style:normal;color:#fff;font-weight:700;font-size:15px;margin-bottom:6px}.m212 .layer ul{margin:0;padding-left:16px}.m212 .join{margin-top:14px;text-align:center;color:#fff;font-size:14px;font-weight:600;border:1px dashed var(--accent);border-radius:10px;padding:10px}.m212 figcaption{font-size:13.5px;color:var(--muted);margin-top:10px;line-height:1.5}.m212 .code{margin:24px 0 8px;border-radius:12px;overflow:hidden;border:1px solid #1e2f47;background:#0b1422}.m212 .code-h{display:flex;justify-content:space-between;align-items:center;gap:12px;font-family:var(--sans);font-size:12.5px;color:#9fb0c6;background:#111d30;padding:9px 14px;border-bottom:1px solid #1e2f47}.m212 .code-h b{color:#fff;font-weight:600}.m212 .code-h .lang{font-family:var(--mono);font-size:11.5px;color:var(--accent)}.m212 .code pre{margin:0;padding:16px 18px;overflow-x:auto;font-family:var(--mono);font-size:13.5px;line-height:1.65;color:#dbe6f3;white-space:pre;background:transparent;border:0}.m212 .code pre .c{color:#6f86a3}.m212 .code-n{font-family:var(--sans);font-size:13.5px;color:var(--muted);margin:0 0 22px;line-height:1.5}.m212 .check{list-style:none;padding:0;margin:20px 0;font-family:var(--sans);font-size:16px;line-height:1.55}.m212 .check li{position:relative;padding:12px 0 12px 34px;border-bottom:1px solid var(--line)}.m212 .check li:last-child{border-bottom:0}.m212 .check li::before{content:\"\";position:absolute;left:4px;top:16px;width:16px;height:16px;border:2px solid var(--accent-dk);border-radius:4px}.m212 .check li strong{display:block;margin-bottom:2px}.m212 .sources{font-family:var(--sans);font-size:14.5px;line-height:1.55;padding-left:28px}.m212 .sources li{margin:0 0 8px;padding-left:4px}.m212 .sources .pub{color:var(--muted)}.m212 .method{font-family:var(--sans);font-size:13.5px;color:var(--muted);border-top:1px solid var(--line);padding-top:18px;margin-top:28px;line-height:1.6}.m212 .author{display:flex;gap:16px;align-items:center;font-family:var(--sans);border:1px solid var(--line);border-radius:14px;padding:18px 20px;margin:40px 0 0}.m212 .avatar{flex:0 0 52px;height:52px;border-radius:50%;background:var(--navy);color:var(--accent);display:flex;align-items:center;justify-content:center;font-weight:800;font-size:18px}.m212 .author p{margin:0;font-size:14.5px;line-height:1.5}.m212 .author p b{color:var(--ink);font-size:15.5px}.m212 .cta{max-width:760px;margin:36px auto 0;padding:0 0 56px}.m212 .cta-box{background:linear-gradient(135deg,var(--navy) 0%,#163150 100%);border-radius:16px;padding:30px;color:#cfdbe9;font-family:var(--sans);display:flex;gap:24px;align-items:center;justify-content:space-between;flex-wrap:wrap}.m212 .cta-box h4{color:#fff;margin:0 0 4px;font-size:20px}.m212 .cta-box p{margin:0;font-size:15px}.m212 .btn{display:inline-block;background:var(--accent);color:#06221a!important;text-decoration:none!important;font-weight:700;font-size:15px;padding:12px 22px;border-radius:10px;white-space:nowrap}.m212 .btn:hover{background:#2be0b4}@media (max-width:760px){.m212{font-size:18px}.m212 .facts-grid{grid-template-columns:repeat(2,1fr)}.m212 .fact:nth-child(2){border-right:0}.m212 .fact:nth-child(-n+2){border-bottom:1px solid var(--line)}.m212 .layers{grid-template-columns:1fr}.m212 .facts{padding:0 12px}}<\/style>\n<article class=\"m212\">\n<header class=\"hero\">\n  <div class=\"hero-inner\">\n    <p class=\"kicker\">Supply-Chain Attack \u00b7 AI Coding Tools<\/p>\n    <p class=\"dek\">For about 11 hours on October 29, Cursor&#8217;s extension marketplace served a tampered Claude Code extension that planted an attacker&#8217;s SSH key and survived being uninstalled. Here&#8217;s what happened, how to check your PC or Mac in a minute, and what to do if you find it.<\/p>\n    <div class=\"byline\"><span>By <strong>El Mostafa Ouchen<\/strong><\/span><span>November 3, 2026<\/span><span>9 min read<\/span><\/div>\n    <div class=\"tags\"><span class=\"tag crit\">Backdoor<\/span><span class=\"tag\">Cursor<\/span><span class=\"tag\">Claude Code extension<\/span><span class=\"tag\">macOS<\/span><span class=\"tag\">Windows<\/span><\/div>\n  <\/div>\n<\/header>\n<div class=\"facts\">\n  <div class=\"facts-grid\">\n    <div class=\"fact\"><div class=\"k\">Package<\/div><div class=\"v\" style=\"font-size:18px\">Anthropic.claude-code<\/div><div class=\"s\">VS Code extension<\/div><\/div>\n    <div class=\"fact\"><div class=\"k\">Versions<\/div><div class=\"v crit\">2.1.312 \u00b7 2.1.313<\/div><div class=\"s\">macOS arm64 \u00b7 Windows x64<\/div><\/div>\n    <div class=\"fact\"><div class=\"k\">Exposure<\/div><div class=\"v\">\u2264 5,000<\/div><div class=\"s\">users, per Cursor<\/div><\/div>\n    <div class=\"fact\"><div class=\"k\">Check for<\/div><div class=\"v crit\" style=\"font-size:19px\">svc-telemetry<\/div><div class=\"s\">in authorized_keys<\/div><\/div>\n  <\/div>\n<\/div>\n<div class=\"wrap\">\n\n<p class=\"lede\">An AI coding extension runs with your permissions, sees your code and can touch your SSH keys. On October 29, 2026, that trust was abused. A tampered copy of the Claude Code extension sat in Cursor&#8217;s marketplace for about eleven hours. Uninstalling it did not remove what it left behind.<\/p>\n\n<div class=\"takeaways\">\n  <h4>Key takeaways<\/h4>\n  <ul>\n    <li><strong>Who&#8217;s at risk:<\/strong> anyone who installed or updated <code>Anthropic.claude-code<\/code> 2.1.312 or 2.1.313 from <strong>Cursor&#8217;s<\/strong> VS Code extension marketplace on Oct 29, 2026, between about 2:27 a.m. and 1:35 p.m. PT.<sup class=\"ref\"><a href=\"#src1\">1<\/a><\/sup><\/li>\n    <li><strong>What it did:<\/strong> it collected host details, added an attacker SSH key labeled <code>svc-telemetry<\/code>, installed startup persistence and tried to open a reverse SSH tunnel.<sup class=\"ref\"><a href=\"#src1\">1<\/a><\/sup><\/li>\n    <li><strong>Uninstalling is not enough.<\/strong> The key and startup scripts stay behind and run on their own.<sup class=\"ref\"><a href=\"#src1\">1<\/a><\/sup><\/li>\n    <li><strong>Not Anthropic&#8217;s build:<\/strong> Cursor says Anthropic did not develop this version. Anthropic says its official channels were not affected.<sup class=\"ref\"><a href=\"#src1\">1<\/a>,<a href=\"#src2\">2<\/a><\/sup><\/li>\n  <\/ul>\n<\/div>\n\n<figure style=\"margin:8px 0 36px\"><div style=\"position:relative;padding-top:56.25%;border-radius:14px;overflow:hidden;background:#000;border:1px solid #1e2f47\"><iframe src=\"https:\/\/www.youtube-nocookie.com\/embed\/4PQ8rTeR408\" title=\"Malicious Claude Code Extension in Cursor: How to Check Your PC or Mac\" style=\"position:absolute;inset:0;width:100%;height:100%;border:0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen loading=\"lazy\"><\/iframe><\/div><figcaption>Watch: the full 7-minute video walkthrough on the <a href=\"https:\/\/youtu.be\/4PQ8rTeR408\" target=\"_blank\" rel=\"noopener\">MAG212 CYBER YouTube channel<\/a>.<\/figcaption><\/figure>\n\n<h2 id=\"what\"><span class=\"num\">01 \/ WHAT HAPPENED<\/span>Eleven hours in a trusted marketplace<\/h2>\n<p>Cursor&#8217;s security notice says that between about 2:27 a.m. and 1:35 p.m. Pacific time on October 29, a maliciously modified Claude Code extension was available in the Cursor VS Code extension marketplace. On October 30, Cursor updated the notice to list two affected versions, 2.1.312 and 2.1.313, built for Apple-silicon Macs and 64-bit Windows.<sup class=\"ref\"><a href=\"#src1\">1<\/a><\/sup> Cursor says up to 5,000 users were affected and that it is contacting them directly.<sup class=\"ref\"><a href=\"#src1\">1<\/a><\/sup><\/p>\n<p>Cursor removed the version and then shut down its whole marketplace as a precaution. It audited access and confirmed no other extensions were tampered with. It rotated its keys, rebuilt the marketplace and brought it back online. It also worked with the hosting provider to take the attacker&#8217;s server offline.<sup class=\"ref\"><a href=\"#src1\">1<\/a><\/sup><\/p>\n<p>Anthropic told The Register that a malicious actor used access to Cursor&#8217;s marketplace to publish the tampered copy, and that versions on its official channels are not affected.<sup class=\"ref\"><a href=\"#src2\">2<\/a><\/sup> Early reports also named other registries. BleepingComputer later reported that Cursor was confirmed as the only source distributing the malicious extension.<sup class=\"ref\"><a href=\"#src3\">3<\/a><\/sup> Cursor has not said publicly how the attacker got access to its marketplace.<\/p>\n\n<h2 id=\"how\"><span class=\"num\">02 \/ HOW IT WORKED<\/span>Five steps, no prompt needed<\/h2>\n<p>Researchers found that the attackers put a malicious JavaScript loader at the top of the extension&#8217;s <code>extension.js<\/code> file and left the rest of the code unchanged. It ran as soon as the editor loaded the extension. The user didn&#8217;t have to interact with Claude Code at all.<sup class=\"ref\"><a href=\"#src3\">3<\/a><\/sup><\/p>\n<figure>\n  <div class=\"diagram\">\n    <p class=\"dtitle\">The attack chain<\/p>\n    <ol class=\"steps\">\n      <li><b>Reconnaissance<\/b>Collects hostname, username, OS and architecture, home folder, environment variable names, working folders, Git email and public IP, then sends them to the attacker.<\/li>\n      <li><b>Attacker SSH key<\/b>Appends an attacker-controlled <code style=\"background:transparent;border:0;color:#9fe8d2;padding:0\">ssh-ed25519<\/code> key labeled <code style=\"background:transparent;border:0;color:#ffb8bd;padding:0\">svc-telemetry<\/code> to <code style=\"background:transparent;border:0;color:#9fe8d2;padding:0\">authorized_keys<\/code>.<\/li>\n      <li><b>Enable SSH<\/b>Tries to turn on the local SSH service. This generally fails without administrator rights.<\/li>\n      <li><b>Reverse tunnel<\/b>Tries to open a reverse SSH tunnel to the attacker&#8217;s server, retrying about every 60 seconds.<\/li>\n      <li><b>Persistence<\/b>macOS: a LaunchAgent labeled <code style=\"background:transparent;border:0;color:#ffb8bd;padding:0\">com.apple.sysmond<\/code>. Windows: a scheduled task <code style=\"background:transparent;border:0;color:#ffb8bd;padding:0\">SysMon<\/code> that tries to run as SYSTEM, with <code style=\"background:transparent;border:0;color:#ffb8bd;padding:0\">sysmon.cmd<\/code> in the Startup folder as a fallback.<\/li>\n    <\/ol>\n  <\/div>\n  <figcaption><strong>Figure 1.<\/strong> MAG212 CYBER illustration of the behavior described in Cursor&#8217;s security notice.<sup class=\"ref\"><a href=\"#src1\">1<\/a><\/sup><\/figcaption>\n<\/figure>\n\n<div class=\"callout note\">\n  <span class=\"lbl\">The good news, and why it&#8217;s not enough<\/span>\n  <p>Cursor says the step that turns on SSH needs administrator rights, so on most Macs and Windows PCs it fails. That would stop the attacker from logging in through the tunnel. But the extension still adds the attacker&#8217;s key, installs persistence and sends host details. Uninstalling the extension may not be enough, because the standalone persistence scripts keep running.<sup class=\"ref\"><a href=\"#src1\">1<\/a><\/sup><\/p>\n<\/div>\n\n<h2 id=\"check\"><span class=\"num\">03 \/ CHECK YOUR MACHINE<\/span>One-minute checks for Mac and Windows<\/h2>\n<p>Cursor&#8217;s notice gives one primary test: look for the <code>svc-telemetry<\/code> key in your SSH authorized keys. If it&#8217;s there, the machine is impacted.<sup class=\"ref\"><a href=\"#src1\">1<\/a><\/sup> The commands below are Cursor&#8217;s checks, followed by MAG212 CYBER&#8217;s extra checks for the persistence files listed in its indicators.<\/p>\n\n<div class=\"code\">\n  <div class=\"code-h\"><b>macOS \u00b7 Cursor&#8217;s key check<\/b><span class=\"lang\">Terminal<\/span><\/div>\n<pre>grep -qs svc-telemetry ~\/.ssh\/authorized_keys \\\n  &amp;&amp; echo \"svc-telemetry key found\" \\\n  || echo \"No key found; machine not impacted\"<\/pre>\n<\/div>\n<div class=\"code\">\n  <div class=\"code-h\"><b>macOS \u00b7 look for the persistence files<\/b><span class=\"lang\">Terminal<\/span><\/div>\n<pre>ls -la ~\/Library\/LaunchAgents\/com.apple.sysmond.plist \\\n       ~\/.config\/.smt ~\/.config\/.smtk 2&gt;\/dev\/null\nls -la \"$TMPDIR\"\/.stk_* 2&gt;\/dev\/null\nlaunchctl list | grep -i sysmond<\/pre>\n<\/div>\n<p class=\"code-n\">Any output from these means you need to respond (see Section 04). Repeat the checks for every user account on the Mac.<\/p>\n\n<div class=\"code\">\n  <div class=\"code-h\"><b>Windows \u00b7 Cursor&#8217;s key check<\/b><span class=\"lang\">PowerShell<\/span><\/div>\n<pre>$files = \"$HOME\\.ssh\\authorized_keys\",\n         \"C:\\ProgramData\\ssh\\administrators_authorized_keys\" |\n         Where-Object { Test-Path $_ }\nif ($files -and (Select-String svc-telemetry $files)) {\n  \"svc-telemetry key found\" } else { \"No key found; machine not impacted\" }<\/pre>\n<\/div>\n<div class=\"code\">\n  <div class=\"code-h\"><b>Windows \u00b7 look for the persistence<\/b><span class=\"lang\">PowerShell<\/span><\/div>\n<pre>Get-ScheduledTask -TaskName SysMon -ErrorAction SilentlyContinue\nTest-Path \"$env:APPDATA\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\sysmon.cmd\"\nTest-Path \"$env:USERPROFILE\\.config\\smt.cmd\", \"$env:USERPROFILE\\.config\\smtk\"\nGet-ChildItem \"$env:TEMP\" -Force -Filter \".stk_*\" -ErrorAction SilentlyContinue<\/pre>\n<\/div>\n<p class=\"code-n\">The key check comes from Cursor&#8217;s notice. The persistence checks are MAG212 CYBER examples built from the file and task names in Cursor&#8217;s indicators.<sup class=\"ref\"><a href=\"#src1\">1<\/a><\/sup> A scheduled task, any <code>True<\/code> or any file listed means you need to respond.<\/p>\n\n<div class=\"callout caution\">\n  <span class=\"lbl\">What a clean result means<\/span>\n  <p>&#8220;No key found&#8221; proves only that the labeled key is not in those files right now. It does not rule out other user accounts, deleted traces or leftover persistence. Run all the checks, on every account. If you manage a fleet, search your endpoint security tools across all devices for the indicators in Section 05.<\/p>\n<\/div>\n\n<h2 id=\"respond\"><span class=\"num\">04 \/ RESPOND<\/span>If you find it<\/h2>\n<ul class=\"check\">\n  <li><strong>1 \u00b7 Isolate the machine<\/strong>Take it off the network. On a work device, preserve evidence and contact your security team before changing anything.<\/li>\n  <li><strong>2 \u00b7 Remove the key, persistence and tunnel<\/strong>Cursor publishes remediation scripts. On macOS, run <code>remediate-macos.sh<\/code> as the affected user, not root. On Windows, run <code>remediate-windows.ps1<\/code> from PowerShell opened as Administrator. The scripts exit with an error if anything remains.<sup class=\"ref\"><a href=\"#src1\">1<\/a><\/sup> Download them only from Cursor&#8217;s official notice.<\/li>\n  <li><strong>3 \u00b7 Rotate credentials from a trusted device<\/strong>Rotate passwords, tokens, SSH keys and cloud credentials that were reachable from the affected machine. Cursor notes that the limited environment-variable collection doesn&#8217;t rule out later credential access through the backdoor.<sup class=\"ref\"><a href=\"#src1\">1<\/a><\/sup><\/li>\n  <li><strong>4 \u00b7 Consider rebuilding<\/strong>Cursor recommends assessing whether to rebuild the host.<sup class=\"ref\"><a href=\"#src1\">1<\/a><\/sup> A cleanup script removes what&#8217;s known. A rebuild also removes what isn&#8217;t.<\/li>\n<\/ul>\n\n<h2 id=\"ioc\"><span class=\"num\">05 \/ FOR IT TEAMS<\/span>Indicators of compromise<\/h2>\n<div class=\"tbl\">\n<table>\n  <thead><tr><th style=\"width:34%\">Type<\/th><th>Indicator (from Cursor&#8217;s notice)<\/th><\/tr><\/thead>\n  <tbody>\n    <tr><td>Attacker host<\/td><td class=\"ver\">134[.]209[.]82[.]225<\/td><\/tr>\n    <tr><td>Beacon<\/td><td class=\"ver\">HTTP POST to :8099\/beacon<\/td><\/tr>\n    <tr><td>Reverse tunnel<\/td><td class=\"ver\">tunnel@134[.]209[.]82[.]225, TCP 22<\/td><\/tr>\n    <tr><td>SSH key comment<\/td><td class=\"ver\">svc-telemetry<\/td><\/tr>\n    <tr><td>Key fingerprint<\/td><td class=\"ver\" style=\"white-space:normal\">SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk<\/td><\/tr>\n    <tr><td>Processes<\/td><td class=\"ver\" style=\"white-space:normal\">ssh -N -R &#8216;*:0:localhost:22&#8217; \u00b7 autossh -M 0<\/td><\/tr>\n    <tr><td>macOS files<\/td><td class=\"ver\" style=\"white-space:normal\">~\/Library\/LaunchAgents\/com.apple.sysmond.plist \u00b7 ~\/.config\/.smt \u00b7 ~\/.config\/.smtk \u00b7 $TMPDIR\/.stk_*<\/td><\/tr>\n    <tr><td>Windows<\/td><td class=\"ver\" style=\"white-space:normal\">Task SysMon \u00b7 Startup\\sysmon.cmd \u00b7 %USERPROFILE%\\.config\\smt.cmd \u00b7 %USERPROFILE%\\.config\\smtk \u00b7 %TEMP%\\.stk_*<\/td><\/tr>\n  <\/tbody>\n<\/table>\n<\/div>\n<p class=\"tbl-note\">Lookups to ifconfig.me or api.ipify.org are legitimate services. Cursor says access to them alone is not an indicator. Check the notice for the latest package and payload hashes.<sup class=\"ref\"><a href=\"#src1\">1<\/a><\/sup><\/p>\n\n<h2 id=\"prevent\"><span class=\"num\">06 \/ PREVENTION<\/span>Make the next extension incident smaller<\/h2>\n<div class=\"tbl\">\n<table>\n  <thead><tr><th style=\"width:38%\">Control<\/th><th>Why it helps<\/th><\/tr><\/thead>\n  <tbody>\n    <tr><td>Inventory editor extensions<\/td><td>You can&#8217;t respond quickly to an incident in a tool you don&#8217;t know you run.<\/td><\/tr>\n    <tr><td>Pin versions on critical tools<\/td><td>A short delay on auto-updates gives marketplaces time to catch a bad release.<\/td><\/tr>\n    <tr><td>Never run your editor as admin<\/td><td>Lack of admin rights is what made the SSH step fail on most machines.<\/td><\/tr>\n    <tr><td>Alert on authorized_keys and startup changes<\/td><td>New SSH keys, LaunchAgents and scheduled tasks are high-signal events.<\/td><\/tr>\n    <tr><td>Keep long-lived secrets out of env vars<\/td><td>Short-lived, scoped credentials are worth less if a machine is exposed.<\/td><\/tr>\n  <\/tbody>\n<\/table>\n<\/div>\n\n<div class=\"callout note\">\n  <span class=\"lbl\">MAG212 CYBER assessment<\/span>\n  <p>AI coding extensions are now part of the software supply chain, and they run with the same rights as the developer. The lesson isn&#8217;t to stop using them. Treat extension updates like any other code you run: inventory them, limit their privileges and watch the places attackers use to persist.<\/p>\n<\/div>\n\n<h2 id=\"sources\"><span class=\"num\">REFERENCES<\/span>Sources<\/h2>\n<ol class=\"sources\">\n  <li id=\"src1\"><a href=\"https:\/\/cursor.com\/blog\/claude-code-extension-security-notice\" target=\"_blank\" rel=\"noopener\">Security notice: malicious version of Anthropic.claude-code identified in the Cursor VS Code Extension Marketplace<\/a> <span class=\"pub\">\u2014 Cursor, Oct 29, 2026 (updated Oct 30)<\/span><\/li>\n  <li id=\"src2\"><a href=\"https:\/\/www.theregister.com\/a\/5306682\" target=\"_blank\" rel=\"noopener\">Anthropic: That Claude Code extension compromise\u2026 couldn&#8217;t be us<\/a> <span class=\"pub\">\u2014 The Register<\/span><\/li>\n  <li id=\"src3\"><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/malicious-claude-code-extension-on-cursor-planted-ssh-backdoors\/\" target=\"_blank\" rel=\"noopener\">Malicious Claude Code extension on Cursor planted SSH backdoors<\/a> <span class=\"pub\">\u2014 BleepingComputer, Oct 30, 2026<\/span><\/li>\n<\/ol>\n<p class=\"method\"><strong>Methodology.<\/strong> Facts were checked against Cursor&#8217;s security notice and the reporting above on November 3, 2026. The persistence checks are MAG212 CYBER examples built from Cursor&#8217;s published indicators and were not run against an infected host. No malware was executed for this article. Disclosure: this article was prepared with help from Claude, an AI assistant made by Anthropic, whose extension is the subject of this incident.<\/p>\n\n<div class=\"author\">\n  <div class=\"avatar\">EO<\/div>\n  <p><b>El Mostafa Ouchen<\/b><br>MAG212 CYBER. Writes practical threat research and defensive guidance for security and engineering teams.<\/p>\n<\/div>\n<\/div>\n<section class=\"cta\">\n  <div class=\"cta-box\">\n    <div><h4>Get the next analysis first<\/h4><p>Practical security research and defensive guidance, free in your inbox.<\/p><\/div>\n    <a class=\"btn\" href=\"https:\/\/cyber.mag212.com\/subscribe-free\/\">Subscribe free<\/a>\n  <\/div>\n<\/section>\n<\/article>\n\n","protected":false},"excerpt":{"rendered":"<p>A tampered Claude Code extension in Cursor\u2019s marketplace planted an attacker SSH key that survives uninstalling. How to check your Mac or Windows PC in a minute, and what to do if you find it.<\/p>","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13,15,14],"tags":[],"class_list":["post-3888","post","type-post","status-publish","format-standard","hentry","category-cyber-incidents","category-threat-intelligence","category-vulnerabilities"],"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/3888","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=3888"}],"version-history":[{"count":2,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/3888\/revisions"}],"predecessor-version":[{"id":3890,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/3888\/revisions\/3890"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=3888"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/categories?post=3888"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/tags?post=3888"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}