Anthropic hacked to deliver remote access trojan to Claude developer laptops

Anthropic Claude

Anthropic hacked via Cursor to deliver remote access trojan to Claude developer laptops worldwide

Kevin Beaumont

4 min read·

7 hours ago

--

Yesterday, Anthropic were compromised via a Cursor VS Code extension used by tens of millions of developers for Claude access was delivering a remote access trojan via an SSH reverse backdoor. The malware allowed hands on and automated remote access to developer laptops and desktops, in a supply chain attack.

Anthropic has not informed customers, and the malicious version was silently deleted without telling anybody.

Update: Anthropic say the breach was Cursor:

“A malicious actor used access to Cursor’s marketplace to publish a tampered extension targeting Cursor’s users, we were not involved with building, publishing, or hosting this”

The extension itself auto updated in Cursor to the malicious version. Cursor say around 5000 developer systems were impacted.

Phorion were the first to notice the malicious activity on endpoints:

The compromised version was 2.1.313. This version was replaced 8 hours ago by Anthropic, with version 2.1.314, which appears to remove the backdoor from the extension but I’m not sure if it still contains no malicious code. It does not remove the SSH backdoor from systems already infected, nor the prior recon activity.

You may notice 2.1.313 is missing from OpenVSX, Visual Studio Marketplace and Cursor:

Press enter or click to view image in full size

Cursor has admitted the issue:

a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code extension Marketplace. The extension runs malicious code that attempts to install a persistent SSH backdoor. Specifically, it:

Collects host and user information: hostname, username, OS, architecture, home directory path, environment variable names, working directories, configured Git email, and public IP.

Attempts to add an attacker-controlled SSH key to authorized_keys, enable the local SSH service, and open a reverse SSH tunnel. Outside of highly unusual circumstances where Cursor was started with administrator privileges, due to errors in the malicious code, this step would fail.

Attempts to make the reverse SSH tunnel persistent via a LaunchAgent (macOS) or a scheduled task that attempts to run as SYSTEM with a Startup-script fallback (Windows). Background scripts retry the tunnel roughly every 60 seconds.

Reports host details and backdoor status via HTTP POST to /beacon on port 8099.

To hunt for the malicious version with Microsoft Defender for Endpoint, I have published KQL queries:

There is some wordsmithing in the Cursor blog, for example: “This malicious version of the extension was not developed by Anthropic” — it was, in fact, uploaded as Anthropic’s verified account. “Developed” is doing some heavy lifting — of course Anthropic didn’t develop the backdoor, there was a security incident leading to a supply chain attack. According to Anthropic the security breach was at Cursor.

Join Medium for free to get updates from this writer.

Notable customers who run Claude Code and Cursor on laptops include Binance, amongst thousands of others.

This is an emerging situation, follow me on Mastodon for updates — @gossithedog@cyberplace.social: