Claude Code-Brand Cursor Extension SSH Backdoor + Fake-Takedown Bank Phishing: OTX Detection Pack

---
title: Trojanized Claude Code Cursor Extension Module Load Execution
id: 8f9c9f25-1e11-4d0d-9d10-5f0bb7a2a001
status: experimental
description: Detects suspicious child processes or script execution spawned by Cursor or extension-host processes shortly after Claude Code extension load, consistent with injected JavaScript credential-theft loader behavior.
author: Security Arsenal
date: 2026/11/05
logsource:
  category: process_creation
  product: windows
  service: sysmon
detection:
  selection_parent:
    ParentImage|contains:
      - 'Cursor'
      - 'Code'
      - 'extensionHost'
  selection_child:
    Image|endswith:
      - '\node.exe'
      - '\powershell.exe'
      - '\cmd.exe'
      - '\curl.exe'
      - '\wget.exe'
      - '\ssh.exe'
  selection_cli:
    CommandLine|contains:
      - 'anthropic.claude-code'
      - 'claude-code'
      - '--eval'
      - 'iex'
      - 'Invoke-Expression'
      - 'curl '
      - 'http://'
      - 'https://'
  condition: selection_parent and selection_child and selection_cli
falsepositives:
  - Legitimate extension telemetry or updates
level: high
tags:
  - attack.execution
  - attack.t1059
  - attack.t1195
---
title: macOS LaunchAgent Persistence With Sysmond-Like Naming
id: 5f6c1a39-7a54-4aa7-90d6-91a7158cc002
status: experimental
description: Detects creation of user LaunchAgents using deceptive system-like names, including MalPlistSysmond-style plist persistence for macOS backdoors.
author: Security Arsenal
date: 2026/11/05
logsource:
  category: file_event
  product: macos
detection:
  selection_path:
    TargetFilename|contains:
      - '/Library/LaunchAgents/'
      - '~/Library/LaunchAgents/'
  selection_name:
    TargetFilename|contains:
      - 'sysmond'
      - 'sysmon'
      - 'systemd'
      - 'com.apple.'
      - 'anthropic'
      - 'claude'
  selection_ext:
    TargetFilename|endswith: '.plist'
  condition: selection_path and selection_ext and selection_name
falsepositives:
  - Legitimate enterprise management agents
level: high
tags:
  - attack.persistence
  - attack.t1543
  - attack.t1053
---
title: Outbound SSH Reverse Tunnel From Developer Workstation
id: 39f9b0f8-0631-4f4f-9aa2-c18a48db8003
status: experimental
description: Detects SSH clients creating remote forwarding or persistent tunnels from endpoints where development extensions or AI coding assistants are installed.
author: Security Arsenal
date: 2026/11/05
logsource:
  category: process_creation
  product: linux
  service: auditd
detection:
  selection_img:
    Image|endswith:
      - '/ssh'
      - '/autossh'
      - '/socat'
      - '/ngrok'
      - '/cloudflared'
  selection_cli:
    CommandLine|contains:
      - ' -R '
      - ' -N '
      - ' -f '
      - 'StrictHostKeyChecking=no'
      - 'ServerAliveInterval'
      - 'localhost.run'
      - 'trycloudflare'
  condition: selection_img and selection_cli
falsepositives:
  - Administrator bastion workflows
level: medium
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.t1572
  - attack.t1090
---
title: Fake Suspended-Page Bank Phishing Domain Grammar
id: b68f5c2a-e82b-4b6d-a0dd-2e80f5f9a004
status: experimental
description: Detects DNS or proxy lookups matching urgency keyword plus financial naming grammar used by look-alike bank phishing domains and fake takedown cloaking infrastructure.
author: Security Arsenal
date: 2026/11/05
logsource:
  category: dns
detection:
  selection_dns:
    QueryName|contains:
      - 'authorize'
      - 'protect'
      - 'secure'
      - 'verify'
      - 'alert'
      - 'suspended'
      - 'primary'
      - 'valley'
      - 'pinnacle'
      - 'commercial'
      - 'treasury'
  selection_finance:
    QueryName|contains:
      - 'bank'
      - 'financial'
      - 'fp'
      - 'cu'
      - 'business'
  condition: selection_dns and selection_finance
falsepositives:
  - Legitimate banking portals and payment providers
level: medium
tags:
  - attack.initial_access
  - attack.t1566
  - attack.t1071

let SuspiciousPhishDomains = dynamic(["53primaryset.com","authorize-valley.com","commercial-atfirst.com","protect-pinnaclefp.com"]);
let PhishGrammar = dynamic(["authorize","protect","secure","verify","alert","suspended","primary","valley","pinnacle","commercial","treasury","business","bank"]);
let FileHashes = dynamic(["7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278","ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15","7d52fa561468f0c77bca112f8393399dec078d02","f49bcd657ef1e626e85ce858958c1769"]);
union isfuzzy=true
(DeviceNetworkEvents
| where TimeGenerated >= ago(14d)
| where RemoteUrl has_any (SuspiciousPhishDomains) or RemoteUrl has_any (PhishGrammar)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Hits=count() by DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName
),
(DeviceProcessEvents
| where TimeGenerated >= ago(14d)
| where (InitiatingProcessFileName has_any ("Cursor","Code","extensionHost","node") and ProcessCommandLine has_any ("anthropic.claude-code","claude-code","-R","autossh","StrictHostKeyChecking=no","Invoke-Expression","iex"))
   or FileName has_any ("ssh","autossh","socat","ngrok","cloudflared")
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Hits=count() by DeviceName, AccountName, FileName, ProcessCommandLine, SHA256
),
(DeviceFileEvents
| where TimeGenerated >= ago(14d)
| where SHA256 has_any (FileHashes) or MD5 has_any (FileHashes) or SHA1 has_any (FileHashes) or FolderPath has_any ("LaunchAgents","anthropic.claude-code","claude-code")
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Hits=count() by DeviceName, FolderPath, FileName, SHA256, MD5, SHA1
)
| order by LastSeen desc

$ErrorActionPreference = 'SilentlyContinue'
$sha256 = @('7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278','ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15')
$md5 = 'f49bcd657ef1e626e85ce858958c1769'
$sha1 = '7d52fa561468f0c77bca112f8393399dec078d02'
$domains = @('53primaryset.com','authorize-valley.com','commercial-atfirst.com','protect-pinnaclefp.com')
$roots = @("$env:USERPROFILE\.cursor\extensions","$env:USERPROFILE\.vscode\extensions","$env:APPDATA\Cursor\User\globalStorage","$env:LOCALAPPDATA\Programs\Cursor","$env:USERPROFILE\Library\Application Support\Cursor\User\globalStorage","$env:USERPROFILE\Library\LaunchAgents")
Write-Output '[*] Hash sweep in extension and cache locations'
foreach ($root in $roots) {
  if (Test-Path $root) {
    Get-ChildItem $root -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
      $h256 = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
      $hm = (Get-FileHash $_.FullName -Algorithm MD5).Hash.ToLower()
      $hs = (Get-FileHash $_.FullName -Algorithm SHA1).Hash.ToLower()
      if ($sha256 -contains $h256 -or $hm -eq $md5 -or $hs -eq $sha1) {
        Write-Output "[HASH-HIT] $($_.FullName) sha256=$h256 md5=$hm sha1=$hs"
      }
    }
  }
}
Write-Output '[*] Claude Code extension version check'
Get-ChildItem "$env:USERPROFILE\.cursor\extensions","$env:USERPROFILE\.vscode\extensions" -Directory -ErrorAction SilentlyContinue | Where-Object { $_.Name -match 'anthropic\.claude-code|claude-code' } | ForEach-Object {
  $pkg = Join-Path $_.FullName 'package.json'
  if (Test-Path $pkg) {
    $json = Get-Content $pkg -Raw | ConvertFrom-Json
    if ($json.version -in @('2.1.313','2.1.312')) { Write-Output "[BAD-VERSION] $($_.FullName) version=$($json.version)" }
  }
}
Write-Output '[*] LaunchAgent plist persistence check'
$la = @("$env:USERPROFILE\Library\LaunchAgents",'/Library/LaunchAgents')
foreach ($p in $la) { if (Test-Path $p) { Get-ChildItem $p -Filter *.plist | Where-Object { $_.Name -match 'sysmond|sysmon|claude|anthropic|com\.apple\.' } | ForEach-Object { Write-Output "[PLIST-REVIEW] $($_.FullName)" } } }
Write-Output '[*] SSH reverse tunnel process check'
Get-CimInstance Win32_Process | Where-Object { $_.Name -match 'ssh|autossh|socat|ngrok|cloudflared' -and $_.CommandLine -match ' -R | -N |StrictHostKeyChecking=no|ServerAliveInterval|trycloudflare|localhost\.run' } | Select-Object ProcessId,Name,CommandLine | Format-List
Write-Output '[*] DNS cache phishing indicator check'
$dns = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($d in $domains) { $hits = $dns | Where-Object { $_.Entry -like "*$d*" -or $_.Data -like "*$d*" }; if ($hits) { $hits | ForEach-Object { Write-Output "[DNS-HIT] $($_.Entry) -> $($_.Data)" } } }
Write-Output '[*] Complete'