安全研究员 Kevin Beaumont 称 Anthropic 官方 Claude 扩展遭黑客入侵并分发木马

Sitemap

Open in app

Get app

Write

Image 1: Unknown user

Mastodon

DoublePulsar

Cybersecurity from the trenches, written by Kevin Beaumont. Opinions are of the author alone, not their employer.

Cybersecurity News

Anthropic Claude

Anthropic hacked to deliver remote access trojan to Claude developer laptops worldwide

Kevin Beaumont

3 min read

1 hour ago

Listen

Yesterday, Anthropic were compromised and a Visual Studio Code and Cursor extension used by tens of millions of developers for Claude access was delivering a remote access trojan via an SSH reverse backdoor. The malware allowed hands on and automated remote access to developer laptops and desktops, in a supply chain attack.

Anthropic has not informed customers, and silently deleted the backdoored version without telling anybody.

The extension itself auto updated in Visual Studio Code (VSCode) and Cursor to the malicious version. The extension has over 40 million installations.

Phorion were the first to notice the malicious activity on endpoints:

Official Claude Code Extension Compromise: Security Advisory | Phorion ### Phorion has detected a backdoor in the official Claude Code for VS Code extension bundle on the Cursor Marketplace that… phorion.io

The compromised version was 2.1.313. This version was replaced 8 hours ago by Anthropic, with version 2.1.314, which appears to remove the backdoor from the extension but I’m not sure if it still contains no malicious code. It does **not**remove the SSH backdoor from systems already infected, nor the prior recon activity.

Get Kevin Beaumont’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

You may notice 2.1.313 is missing from OpenVSX, Visual Studio Marketplace and Cursor:

Press enter or click to view image in full size

Cursor has admitted the issue:

Security notice - malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor… ### Today we identified a security incident involving a specific extension package in the Cursor VS Code extension… cursor.com

a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code extension Marketplace. The extension runs malicious code that attempts to install a persistent SSH backdoor. Specifically, it:

Collects host and user information: hostname, username, OS, architecture, home directory path, environment variable names, working directories, configured Git email, and public IP.

Attempts to add an attacker-controlled SSH key to authorized_keys, enable the local SSH service, and open a reverse SSH tunnel. Outside of highly unusual circumstances where Cursor was started with administrator privileges, due to errors in the malicious code, this step would fail.

Attempts to make the reverse SSH tunnel persistent via a LaunchAgent (macOS) or a scheduled task that attempts to run as SYSTEM with a Startup-script fallback (Windows). Background scripts retry the tunnel roughly every 60 seconds.

Reports host details and backdoor status via HTTP POST to /beacon on port 8099.

To hunt for the malicious version with Microsoft Defender for Endpoint, I have published KQL queries: