Anthropic 黑客向全球Claude 开发者笔记本电脑提供远程访问trojan
昨天，Anthropic被泄露，千千万万开发者为Claude访问使用的Visual Studio代码和Cursor扩展正在通过SSH反向后门提供远程访问trojan. 在供应链攻击中，恶意软件允许操作和自动远程访问开发商笔记本电脑和桌面。
Anthropic没有通知客户，默默删除了后门版本，不告诉任何人。
扩展本身在Visual Studio代码(VSCode)和Cursor更新到恶意版本。 扩建工程拥有4000多万个设施。
Phorion是第一个注意到端点恶意活动的：
失密版本为2.1.313. 这个版本在8小时前被Anthropic取代，它不从已经感染的系统移除SSH后门，也不去除之前的侦察活动。
将Kevin Beaumont的故事输入您的收件箱
加入 MED 免费从此作者获取更新。
您可能注意到2.1.313在OpenVSX,Visual Studio Marketplace和Cursor丢失：
Cursor承认此事：
Anthropic的Claude Code扩展的恶意修改版本在Cursor VS代码扩展市场中提供。 扩展运行恶意代码，试图安装持久的SSH后门。 具体而言：
收集主机和用户信息：主机名，用户名，OS，架构，家目录路径，环境变量名，工作目录，配置的Git电子邮件，以及公共IP.
尝试在授权的 keys中添加攻击者控制的SSH密钥，启用本地SSH服务，并打开逆向SSH隧道。 除了Cursor以管理员权限开始的非常不寻常的情况外，由于恶意代码错误，这一步骤将失败。
试图通过一个LOUTAgent(macOS)或一个计划任务使反向SSH隧道持续运行，该任务试图作为System运行，并带有一个启动符折返(Windows). 背景脚本大约每60秒重试一次隧道。
报告主机细节和后门状态通过HTTP POST 到/beacon在8099端口。
为了与Microsoft Defender for Endpoint一同寻找恶意版本，我发布了KQL查询：
在笔记本电脑上运行Claude Code的著名客户包括宾南斯等数千人。
@gossithedog@cyberplace. 社会：
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Anthropic hacked to deliver remote access trojan to Claude developer laptops worldwide
Yesterday, Anthropic were compromised and a Visual Studio Code and Cursor extension used by tens of millions of developers for Claude access was delivering a remote access trojan via an SSH reverse backdoor. The malware allowed hands on and automated remote access to developer laptops and desktops, in a supply chain attack.
Anthropic has not informed customers, and silently deleted the backdoored version without telling anybody.
The extension itself auto updated in Visual Studio Code (VSCode) and Cursor to the malicious version. The extension has over 40 million installations.
Phorion were the first to notice the malicious activity on endpoints:
The compromised version was 2.1.313. This version was replaced 8 hours ago by Anthropic, with version 2.1.314, which appears to remove the backdoor from the extension but I’m not sure if it still contains no malicious code. It does not remove the SSH backdoor from systems already infected, nor the prior recon activity.
Get Kevin Beaumont’s stories in your inbox
Join Medium for free to get updates from this writer.
You may notice 2.1.313 is missing from OpenVSX, Visual Studio Marketplace and Cursor:
Cursor has admitted the issue:
a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code extension Marketplace. The extension runs malicious code that attempts to install a persistent SSH backdoor. Specifically, it:
Collects host and user information: hostname, username, OS, architecture, home directory path, environment variable names, working directories, configured Git email, and public IP.
Attempts to add an attacker-controlled SSH key to authorized_keys, enable the local SSH service, and open a reverse SSH tunnel. Outside of highly unusual circumstances where Cursor was started with administrator privileges, due to errors in the malicious code, this step would fail.
Attempts to make the reverse SSH tunnel persistent via a LaunchAgent (macOS) or a scheduled task that attempts to run as SYSTEM with a Startup-script fallback (Windows). Background scripts retry the tunnel roughly every 60 seconds.
Reports host details and backdoor status via HTTP POST to /beacon on port 8099.
To hunt for the malicious version with Microsoft Defender for Endpoint, I have published KQL queries:
Notable customers who run Claude Code on laptops include Binance, amongst thousands of others.
This is an emerging situation, follow me on Mastodon for updates — @gossithedog@cyberplace.social:
Auto-fetched and translated by AI Atlas. All rights belong to the original author.