Anthropic hacked to deliver remote access trojan to Claude developer laptops worldwide - DoublePulsar
Anthropic's Claude Code extension was compromised via a malicious Cursor VS Code update, delivering a remote access trojan to developer laptops worldwide.
The breach began when a malicious actor gained access to Cursor's marketplace to publish a tampered version of Anthropic's Claude Code extension. This compromised update, version 2.1.313, was silently pushed to users and allowed the installation of a remote access trojan via an SSH reverse backdoor.
The malware collected extensive host and user information, including hostname, username, OS architecture, and environment variables. It then attempted to add an attacker-controlled SSH key to authorized_keys and establish a persistent reverse SSH tunnel to an external server.
The malicious code included mechanisms to maintain persistence across reboots. On macOS, it used a LaunchAgent, while on Windows, it relied on a scheduled task with a Startup-script fallback. Background scripts repeatedly attempted to re-establish the tunnel every 60 seconds.
The compromised extension also sent beacon reports to an attacker-controlled server at hxxp://134[.]209[.]82[.]225:8099/beacon. Security researcher Kevin Beaumont identified the malicious activity and published KQL queries for Microsoft Defender for Endpoint to detect the threat.
Anthropic stated that the breach occurred at Cursor, not with their involvement. The malicious version was replaced with 2.1.314 eight hours after detection, but this update does not remove the backdoor from already infected systems or prior recon activity.
The incident highlights the risks of supply chain attacks in the developer ecosystem. Notable customers, including Binance, were affected, raising concerns about the security of tools used by millions of developers worldwide.
Attack details and response
The malicious extension was uploaded under Anthropic's verified account, misleading users into trusting the compromised update. Cursor acknowledged the issue, stating that the malicious version was not developed by Anthropic but was published through their marketplace.
A malicious actor used access to Cursor’s marketplace to publish a tampered extension targeting Cursor’s users, we were not involved with building, publishing, or hosting this
The malicious version was removed from OpenVSX, the Visual Studio Marketplace, and Cursor's repository. However, the SSH backdoor remains active on systems that were already infected, leaving a lingering security risk.
The attack underscores the importance of vigilance in software supply chains. Developers relying on third-party extensions must verify the authenticity of updates and remain alert to unusual system behavior.
Related
