Fake Claude Code extensions in Cursor: Malicious activity after the exposure window

The fake Claude Code extensions (versions 2.1.312 and 2.1.313) are malicious copies of Anthropic’s Claude Code extension that Cursor’s VS Code extension marketplace served on October 29, 2026. Anthropic didn’t build them. They look and work like the real thing, but they try to plant an SSH backdoor on developer machines, and uninstalling them may not remove it.

On October 29, 2026, Cursor’s VS Code extension marketplace served fake Claude Code extensions (versions 2.1.312 and 2.1.313) that try to plant an SSH backdoor on developer machines.

In one of our four Expel incidents, the first malicious activity came 8 hours after Cursor’s stated exposure window closed.

Organizations that only check that 11-hour window could miss infected machines.

Uninstalling the extension may not remove the backdoor, according to Cursor . The persistence has to be removed separately.

On October 29, 2026, Cursor’s VS Code extension marketplace served fake versions of the Claude Code extension (versions 2.1.312 and 2.1.313) that try to plant an SSH backdoor on developer machines, according to Cursor .

Between October 29 and 30, Expel investigated four incidents tied to this extension at four customers. Each involved one Mac:

Three ran CrowdStrike Falcon and one ran Microsoft Defender for Endpoint.

Three started inside Cursor’s stated exposure window.

One started 8 hours after it closed.

That means some organizations may be scoping too narrowly.

Indicators of compromise (IOCs)

How does the fake Claude Code extension backdoor work?

Cursor is a popular code editor. Like most editors, it supports extensions, which are add-ons that give it extra features. Claude Code is Anthropic’s AI coding assistant, and many developers install its extension.

On October 29, Cursor’s extension store served two fake versions of that extension, 2.1.312 and 2.1.313. Anthropic didn’t build them. It looked and worked like the real thing while setting up a hidden back door into users’ computers.

The back door had three parts:

A spare key: The malware tries to add the attacker’s SSH key to the user’s list of keys allowed to log in. SSH is a standard way to log in to a computer remotely. Think of it as copying a house key and leaving it under the doormat.

A tunnel: It opens an outbound connection (a reverse SSH tunnel) from the computer to the attacker’s server. Because the connection starts from inside, it can get past firewalls that block incoming traffic. In one of our incidents, the tunnel connected out even when the user wasn’t an admin. According to Cursor, the attacker can only log in through the tunnel if the computer’s remote login feature (SSH) is turned on.

Persistence: On Macs, it installed a launch agent named to look like an Apple component. The launch agent restarts the tunnel when the user logs in, and a background loop retries the connection every 60 seconds. Windows and Linux machines get their own persistence, per Cursor. Cursor says uninstalling the extension may not remove this.

It also sent details the computer to the attacker’s server, according to Cursor . These included the hostname, username, Git email, public IP, and the names of environment variables. Phorion , a macOS security firm, says it sent up to 40 variable names that look like keys or tokens, which tells the attacker which machines hold credentials. The values themselves stayed on the machine. Cursor says the malware targets macOS and Windows, and its indicators also cover Linux. Phorion also describes Linux persistence. All four computers in our incidents were Macs.

When was the fake Claude Code extension live in Cursor?

October 29, 2:27am PT (09:27 UTC): Fake extensions go live in Cursor’s store.

October 29, 1:35pm PT (20:35 UTC): Cursor removes them. The window was 11 hours.

October 29: Cursor publishes its security notice. Cursor says it worked with the hosting provider to take the attacker’s server offline but doesn’t say when.

October 30, 04:45 UTC ( 8 hours after the window closed): An Expel customer Mac first shows malicious activity.

October 30, 14:29 UTC: The tunnel on that Mac is still connecting out to the attacker’s IP.

October 30, 11:30am PT (18:30 UTC): Cursor updates its notice to add version 2.1.312 and correct its indicators.

What did Expel see after Cursor’s exposure window closed?

Malicious activity started after the official window closed

Cursor’s guidance focuses on people who installed between 2:27am and 1:35pm PT on October 29. In one incident, the first malicious activity came at 04:45 UTC on October 30, 8 hours after the window closed.

The timing fits a download during the window that didn’t run until Cursor opened. On that Mac, the user logged in at 04:44 UTC, Cursor opened the same minute, and the malicious code ran at 04:45 as Cursor started up. We haven’t confirmed when the extension was downloaded. We have no evidence that Cursor’s store kept serving the fake extension after removing it.

Either way, it only takes one late case to show the point: Organizations that only check that 11-hour window could miss infected machines.

The back door kept running on its own

On one Mac, the launch agent kept the tunnel connecting out to the attacker’s IP for nearly 10 hours, from 04:45 to 14:29 UTC on October 30. That persistence runs on its own, apart from the extension, so it has to be removed too.

Cursor says admin rights block the login step on most machines. Don’t count on it

Cursor says the attacker can only log in through the tunnel if remote login (SSH) is turned on, and turning it on takes admin rights. In one of our incidents, the tunnel still connected out on a Mac where the user wasn’t an admin.

According to Cursor, the extension doesn’t have admin rights on most macOS and Windows machines. On those machines, the step fails and the attacker can’t log in through the tunnel. But two caveats matter:

At least one affected user in our incidents was a local admin.

Remote login may already be on. Phorion notes that on a Mac where remote login is already on, or gets turned on later, the backdoor is ready to use.

Cursor says the extension still adds the attacker’s key, installs persistence, and sends host details, regardless of admin rights. Don’t assume you’re in the safe majority.

How did Expel detect the fake Claude Code extension?

Our customers’ endpoint security tools flagged this: CrowdStrike Falcon in three incidents and Microsoft Defender for Endpoint in one. The clues that gave it away:

The code editor doing things a code editor shouldn’t, like checking remote login settings and creating startup programs

An outbound SSH connection to an internet server that CrowdStrike threat intel or Microsoft’s Defender Experts had already flagged

The code editor adding a new key to the user’s list of SSH keys allowed to log in

Why are attackers targeting developer tools?

This attack came a week after another developer-tool supply chain attack: LiteLLM, version 1.107.0, on October 21, which Expel also responded to.

Attackers are going after the tools developers trust: extensions, AI coding tools and software packages. In our experience, few organizations track which editor extensions their developers have installed.

How do you check for and remove the fake Claude Code extension?

Check whether anyone in your org uses Cursor, and whether they had Claude Code extension versions 2.1.312 or 2.1.313.

Don’t stop at the October 29 window. Check every machine that runs Cursor.

Use the one-line check and cleanup scripts in Cursor’s security notice . Cursor’s quick test looks for an SSH key labeled svc-telemetry . That check alone can miss infected machines. In one of our incidents, the tunnel was running but we found no attacker key. Also check for: Connections to 134.209.82[.]225 on any port Command lines containing [email protected][.]225 , or -R *:0:localhost:22 with StrictHostKeyChecking=no Files named .stk_ followed by 10 hex characters in the macOS temp folder ~/.config/.smt , ~/.config/.smtk and ~/Library/LaunchAgents/com.apple.sysmond.plist Windows and Linux file paths (see the IOC table above) The file hashes in the IOC table above

Connections to 134.209.82[.]225 on any port

Command lines containing [email protected][.]225 , or -R *:0:localhost:22 with StrictHostKeyChecking=no

Files named .stk_ followed by 10 hex characters in the macOS temp folder

~/.config/.smt , ~/.config/.smtk and ~/Library/LaunchAgents/com.apple.sysmond.plist

Windows and Linux file paths (see the IOC table above)

The file hashes in the IOC table above

If a machine was affected, disconnect it from the network, clean it up (or rebuild it), and use a different, trusted computer to change any passwords and access keys that were on the affected machine.

To check whether anyone logged in, Phorion suggests searching SSH logs for logins from localhost that used the svc-telemetry key.

Longer term, keep track of which editor extensions developers install, and consider waiting a few days before allowing brand-new versions.

Cursor says the attacker’s server no longer works. The risk is ongoing for any machine that hasn’t been cleaned up.