Anthropic hacked to deliver remote access trojan

Anthropic Claude

Anthropic hacked to deliver remote access trojan to Claude developer laptops worldwide

Kevin Beaumont

3 min read·

1 hour ago

--

Yesterday, Anthropic were compromised and a Visual Studio Code and Cursor extension used by tens of millions of developers for Claude access was delivering a remote access trojan via an SSH reverse backdoor. The malware allowed hands on and automated remote access to developer laptops and desktops, in a supply chain attack.

Anthropic has not informed customers, and silently deleted the backdoored version without telling anybody.

The extension itself auto updated in Visual Studio Code (VSCode) and Cursor to the malicious version. The extension has over 40 million installations.

Phorion were the first to notice the malicious activity on endpoints:

The compromised version was 2.1.313. This version was replaced 8 hours ago by Anthropic, with version 2.1.314, which appears to remove the backdoor from the extension but I’m not sure if it still contains no malicious code. It does not remove the SSH backdoor from systems already infected, nor the prior recon activity.

Join Medium for free to get updates from this writer.

You may notice 2.1.313 is missing from OpenVSX, Visual Studio Marketplace and Cursor:

Press enter or click to view image in full size

Cursor has admitted the issue:

a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code extension Marketplace. The extension runs malicious code that attempts to install a persistent SSH backdoor. Specifically, it:

Collects host and user information: hostname, username, OS, architecture, home directory path, environment variable names, working directories, configured Git email, and public IP.

Attempts to add an attacker-controlled SSH key to authorized_keys, enable the local SSH service, and open a reverse SSH tunnel. Outside of highly unusual circumstances where Cursor was started with administrator privileges, due to errors in the malicious code, this step would fail.

Attempts to make the reverse SSH tunnel persistent via a LaunchAgent (macOS) or a scheduled task that attempts to run as SYSTEM with a Startup-script fallback (Windows). Background scripts retry the tunnel roughly every 60 seconds.

Reports host details and backdoor status via HTTP POST to /beacon on port 8099.

To hunt for the malicious version with Microsoft Defender for Endpoint, I have published KQL queries:

Notable customers who run Claude Code on laptops include Binance, amongst thousands of others.

This is an emerging situation, follow me on Mastodon for updates — @gossithedog@cyberplace.social: