Claude Code: Detect & Block Trojanized Extension

Executive Summary

A recently discovered malware campaign has compromised the Claude Code extension, a legitimate tool developed by Anthropic, by distributing a trojanized version through the Cursor Marketplace. This malicious update, disguised as a legitimate version 2.1.313, installs a persistent SSH backdoor on affected systems, posing a significant operational risk to approximately 5,000 users. The attackers leveraged the legitimate publisher identity of the extension to distribute the compromised package, which was subsequently removed from the marketplace.

The root cause of this incident is attributed to the unauthorized update being introduced into the Cursor Marketplace, although the exact method used by the attackers remains unclear. The malicious version of the extension contains a 66-line loader inserted before the legitimate code, allowing it to maintain its disguise as a legitimate update. This tactic highlights the threat adversary's ability to blend in with legitimate software, making it challenging to detect and block such malware.

Immediate defensive action is required to mitigate the risk associated with this malware campaign. Users who installed the Claude Code extension through the Cursor Marketplace should take prompt action to inspect their systems for signs of compromise and remove the malicious extension. Furthermore, organizations should review their extension management processes to prevent similar incidents in the future, emphasizing the importance of verifying the authenticity and integrity of software updates to prevent the installation of trojanized extensions.

Active malware campaigns present imminent risks of lateral movement, credential theft, and ransomware deployment. Security operations teams must rapidly isolate affected hosts, block command-and-control infrastructure, and execute endpoint containment runbooks.

---

Malware Execution Mechanics & Attack Chain

Ingress, Dropper & Persistence Architecture

The root cause of this security incident lies in the unauthorized modification of the legitimate Claude Code VS Code extension, which was distributed through the Cursor IDE extension marketplace. The malicious version, masquerading as version 2.1.313, contained a 66-line loader inserted before the legitimate extension code, allowing attackers to execute arbitrary code on the user's system. This modification enabled the attackers to bypass the extension's intended functionality and inject malicious code, ultimately leading to the addition of an attacker-controlled key to the user's ~/.ssh/authorized_keys file.

The exploitation mechanics involve a logic bypass, where the malicious loader is executed before the legitimate extension code, allowing the attackers to manipulate the extension's behavior. The fact that the malicious version was distributed under the legitimate Claude Code extension ID, rather than as a separate fake extension, suggests a sophisticated attack strategy. The attackers likely exploited a vulnerability in the marketplace's validation process, enabling them to upload the modified extension without detection. This vulnerability, combined with the lack of robust validation and verification mechanisms, allowed the malicious extension to be installed by unsuspecting users.

The traversal from unauthenticated external ingress to process execution occurred through the compromised extension, which was designed to activate after VS Code startup and when its webview opens. At this point, the malicious loader was executed, allowing the attackers to add the attacker-controlled key to the user's ~/.ssh/authorized_keys file, labeled as "svc-telemetry" to evade detection. This key addition enabled the attackers to establish a persistent backdoor, facilitating future unauthorized access to the user's system. The removal of the malicious version and the publication of a new, legitimate version (2.1.314) by Anthropic have mitigated the immediate risk, but the incident highlights the need for enhanced validation and verification mechanisms in extension marketplaces to prevent similar attacks.

Command-and-Control (C2) & Anti-Forensics Analysis

The payload establishes encrypted communication channels with resilient multi-tier proxy infrastructure. Threat actors utilize scheduled tasks, registry modifications, or process injection to establish persistent execution without disk footprint.

---

MITRE ATT&CK Tactics, Techniques & Procedures (TTPs)

---

Threat Actor Profile & Attribution

Campaign attribution points to financially motivated cybercrime syndicates specializing in enterprise double-extortion and data exfiltration. Operators actively tailor extortion notes, maintain dedicated dark-web leak sites, and leverage automated deployment frameworks across victim domains.

---

SOC Defense & Incident Response Playbook

1. Endpoint Quarantine & Host Remediation

• Immediately isolate compromised hosts from the local subnet via EDR network containment.
• Terminate suspicious parent-child process chains and remove unauthorized startup services and scheduled tasks.

2. Perimeter C2 Severance & Firewall Rules

• Block all outbound connections to identified C2 IP addresses and suspicious dynamic DNS domains.
• Implement strict DNS sinkholing to capture and redirect beaconing endpoints for forensic review.

3. Behavioral Detection & Hunting Query

Sigma Rule: Malicious Script Execution with Obfuscated Parameters

title: Suspicious Obfuscated PowerShell Execution
id: d7f1a3e9-0b42-4f91-8812-malware-inc-139
status: experimental
description: Detects obfuscated command lines indicative of malware droppers or in-memory loaders.
references:
  - https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html?ref=cybernewsai.com
https://www.darkreading.com/cyberattacks-data-breaches/devs-trojanized-claude-code-extension-cursor?ref=cybernewsai.com
https://www.helpnetsecurity.com/2026/10/30/claude-code-extension-ssh-backdoor/?ref=cybernewsai.com
author: CyberNewsAI Threat Research Team
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - '-enc'
      - '-w hidden'
      - 'FromBase64String'
      - 'IEX'
  condition: selection
level: high
tags:
  - attack.execution
  - attack.t1059.001

Microsoft Sentinel Hunting Query (KQL)

DeviceProcessEvents
| where ProcessCommandLine has_any ("-enc", "FromBase64String", "vssadmin delete shadows", "wbadmin delete catalog")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by TimeGenerated desc

---

Indicators of Compromise (IOCs)

No specific binary hashes were published in the authoritative advisory; hunt using behavioral telemetry and detection rules above.