Anthropic Breach: Claude Extension Delivered RAT to Developers

3 min read

1 hour ago

--

Yesterday, Anthropic were compromised and a Visual Studio Code and Cursor extension used by tens of millions of developers for Claude access was delivering a remote access trojan via an SSH reverse backdoor. The malware allowed hands on and automated remote access to developer laptops and desktops, in a supply chain attack.

Anthropic has not informed customers, and silently deleted the backdoored version without telling anybody.

The extension itself auto updated in Visual Studio Code (VSCode) and Cursor to the malicious version. The extension has over 40 million installations.

Phorion were the first to notice the malicious activity on endpoints:

The compromised version was 2.1.313. This version was replaced 8 hours ago by Anthropic, with version 2.1.314, which appears to remove the backdoor from the extension but I’m not sure if it still contains no malicious code. It does notremove the SSH backdoor from systems already infected, nor the prior recon activity.

Get Kevin Beaumont’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

You may notice 2.1.313 is missing from OpenVSX, Visual Studio Marketplace and Cursor:

Press enter or click to view image in full size

Press enter or click to view image in full size

Cursor has admitted the issue:

a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code extension Marketplace. The extension runs malicious code that attempts to install a persistent SSH backdoor. Specifically, it:

Collects host and user information: hostname, username, OS, architecture, home directory path, environment variable names, working directories, configured Git email, and public IP.

Attempts to add an attacker-controlled SSH key to authorized_keys, enable the local SSH service, and open a reverse SSH tunnel. Outside of highly unusual circumstances where Cursor was started with administrator privileges, due to errors in the malicious code, this step would fail.

Attempts to make the reverse SSH tunnel persistent via a LaunchAgent (macOS) or a scheduled task that attempts to run as SYSTEM with a Startup-script fallback (Windows). Background scripts retry the tunnel roughly every 60 seconds.

Reports host details and backdoor status via HTTP POST to /beacon on port 8099.

To hunt for the malicious version with Microsoft Defender for Endpoint, I have published KQL queries:

Notable customers who run Claude Code on laptops include Binance, amongst thousands of others.

This is an emerging situation, follow me on Mastodon for updates — @[email protected]:

Press enter or click to view image in full size