Cursor IDE - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/cursor-ide/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 30 Oct 2026 22:04:22 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAnthropic Claude VS Code extension malicious update distributionhttps://feed.craftedsignal.io/briefs/2026-10-cursor-extension-hijack/Fri, 30 Oct 2026 22:04:22 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-cursor-extension-hijack/An unknown actor compromised an official Anthropic distribution channel to push a malicious version of the Claude VS Code extension, enabling persistent SSH backdoors and credential theft on developer workstations.Between approximately 05:27 and 16:35 ET on October 29, 2026, a malicious version (2.1.313) of the Anthropic Claude VS Code extension was distributed via the official Cursor marketplace. The compromise was a supply-chain attack resulting from unauthorized access to Anthropic's distribution account. The malicious extension executed host reconnaissance, attempted to establish persistent SSH access, and exfiltrated environment variables and configuration files. Anthropic has since released version 2.1.314, though this update does not remove persistence mechanisms installed by the malicious 2.1.313 version.

Attack Chain

  1. Unauthorized access to the Anthropic official account on the Cursor extension marketplace.
  2. Publication of malicious extension version 2.1.313, superseding the legitimate 2.1.312 version.
  3. Automatic distribution to developer workstations configured for auto-updates.
  4. Execution of reconnaissance commands to collect host/user data and environment variable inventory.
  5. Attempted modification of SSH configurations (authorized_keys) and initialization of a reverse SSH tunnel.
  6. Persistence established via platform-specific mechanisms (LaunchAgents on macOS; scheduled tasks on Windows).
  7. Exfiltration of configuration and credential data via HTTP POST beacons on port 8099.

Impact

Up to 5,000 developers' workstations were potentially exposed. Confirmed impact includes local host information gathering, potential theft of cloud credentials and API tokens stored in environment variables, and unauthorized persistence via SSH and system-level scheduled tasks.

Recommendation

  1. Audit all developer workstations for the presence of the malicious extension version 2.1.313.
  2. If version 2.1.313 was present, perform a full forensic sweep; updating to version 2.1.314 does not remediate established persistence.
  3. Rotate all API keys, cloud credentials, and SSH keys present on affected developer machines.
  4. Check for unauthorized entries in ~/.ssh/authorized_keys (Linux/macOS) or Windows-equivalent SSH configurations.
  5. Inspect system-level persistence mechanisms, specifically checking for newly created LaunchAgents on macOS or suspicious scheduled tasks running as SYSTEM on Windows.
  6. Monitor network egress for HTTP POST traffic on port 8099.
]]>highadvisorysupply-chainidetrojanpersistenceexfiltrationbackdoorcredential-theftdeveloper-tools