Cursor Supply Chain Attack: Malicious Claude Code Extension Deploys Reverse SSH Tunnels

---
title: Reverse SSH Tunnel Establishment via SSH Client
id: 8f7a2b1c-3e4d-4c5a-9b8f-1a2b3c4d5e6f
status: experimental
description: Detects SSH client execution with remote port forwarding flags, commonly used in reverse tunnel attacks to establish C2 channels through outbound connections.
references:
  - https://attack.mitre.org/techniques/T1572/
  - https://www.securityweek.com/malicious-claude-code-extension-served-in-cursor-supply-chain-attack/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.command_and_control
  - attack.t1572
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\ssh.exe'
      - '\sshd.exe'
    CommandLine|contains:
      - ' -R '
      - ' -L '
      - ' -D '
  condition: selection
falsepositives:
  - Legitimate administrative SSH tunneling for remote access
  - Database administrators using SSH tunnels for secure database connections
level: high
---
title: SSH Connection to Non-Standard High Ports
id: 9a8b7c6d-5e4f-3a2b-1c9d-8e7f6a5b4c3d
status: experimental
description: Detects SSH connections to high-numbered ports (10000-65535) which are uncommon for legitimate SSH administration but frequently used in reverse tunnel configurations.
references:
  - https://attack.mitre.org/techniques/T1571/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.command_and_control
  - attack.t1571
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\ssh.exe'
      - '\sshd.exe'
    DestinationPort|gte: 10000
  condition: selection
falsepositives:
  - Legacy applications using non-standard SSH ports
  - Development environments with custom SSH configurations
level: medium
---
title: Suspicious Process Spawning SSH Client
id: 7c6d5e4f-3a2b-1c9d-8e7f-6a5b4c3d2e1f
status: experimental
description: Detects code editors, IDEs, or text editors spawning SSH client processes, potentially indicating malicious extension activity or supply chain compromise.
references:
  - https://attack.mitre.org/techniques/T1195/
  - https://attack.mitre.org/techniques/T1572/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.initial_access
  - attack.t1195
  - attack.command_and_control
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\cursor.exe'
      - '\code.exe'
      - '\code-insiders.exe'
      - '\atom.exe'
      - '\sublime_text.exe'
  selection_child:
    Image|endswith:
      - '\ssh.exe'
      - '\sshd.exe'
      - '\plink.exe'
      - '\putty.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Integrated terminal usage within IDEs for legitimate SSH sessions
  - DevOps engineers using IDE terminals for server management
level: high

// Hunt for SSH tunneling activity from developer workstations
let SSHProcesses = DeviceProcessEvents
| where FileName in~ ("ssh.exe", "sshd.exe", "ssh", "sshd")
| where ProcessCommandLine has_any (" -R ", " -L ", " -D ", "-o ServerAliveInterval")
| project DeviceId, TimeGenerated, FileName, ProcessCommandLine, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine;

SSHProcesses
| join kind=inner (
    DeviceNetworkEvents
    | where RemotePort >= 10000 or RemotePort == 22
    | where InitiatingProcessFileName in~ ("ssh.exe", "sshd.exe", "ssh", "sshd")
    | project DeviceId, TimeGenerated, RemoteIP, RemotePort, RemoteUrl
) on DeviceId
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, RemoteIP, RemotePort, InitiatingProcessFileName
| order by TimeGenerated desc

// Hunt for IDE processes spawning suspicious command-line tools
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("cursor.exe", "code.exe", "code", "cursor")
| where FileName in~ ("ssh.exe", "sshd.exe", "netstat.exe", "ifconfig", "ipconfig.exe", "whoami.exe", "hostname.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName, SHA256
| order by TimeGenerated desc

-- Hunt for SSH tunneling processes and their network connections
SELECT 
    Pid,
    Name,
    CommandLine,
    Exe,
    Username,
    CreateTime,
    Netstat.LocalIP,
    Netstat.LocalPort,
    Netstat.RemoteIP,
    Netstat.RemotePort,
    Netstat.Status
FROM pslist()
JOIN netstat() ON Pid = Netstat.Pid
WHERE CommandLine =~ '(ssh|sshd).*(-R|-L|-D|ServerAlive)'
   OR (Name =~ 'ssh|sshd' AND Netstat.RemotePort >= 10000)

-- Hunt for IDE processes with suspicious child processes indicating extension activity
SELECT 
    Pid,
    Ppid,
    Name,
    CommandLine,
    Exe,
    Username,
    CreateTime,
    Parent.Name as ParentName,
    Parent.CommandLine as ParentCommandLine
FROM pslist()
WHERE Parent.Name =~ '(cursor|code|code-insiders|sublime|atom)'
  AND Name =~ '(ssh|sshd|netstat|ifconfig|ipconfig|whoami|hostname|uname)'

# Cursor Supply Chain Compromise Detection and Remediation Script
# Requires administrative privileges for process termination

Write-Host "[+] Scanning for suspicious SSH processes and Cursor extensions..." -ForegroundColor Cyan

# Check for SSH processes with tunneling flags
$SuspiciousSSH = Get-Process | Where-Object {
    ($_.Name -match "ssh|sshd") -and 
    ($_.CommandLine -match "\-R|\-L|\-D")
}

if ($SuspiciousSSH) {
    Write-Host "[!] ALERT: Found SSH processes with tunneling flags:" -ForegroundColor Red
    $SuspiciousSSH | Select-Object Name, Id, CommandLine | Format-Table -AutoSize
    
    $Confirm = Read-Host "Do you want to terminate these processes? (Y/N)"
    if ($Confirm -eq "Y") {
        $SuspiciousSSH | Stop-Process -Force
        Write-Host "[+] Terminated suspicious SSH processes" -ForegroundColor Green
    }
}

# Check for network connections on high ports
$HighPortConnections = Get-NetTCPConnection | Where-Object {
    ($_.RemotePort -ge 10000 -and $_.RemotePort -ne 0) -and
    ($_.OwningProcess -ne 0)
} | ForEach-Object {
    $Process = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    if ($Process.Name -match "ssh|sshd") {
        [PSCustomObject]@{
            ProcessName = $Process.Name
            ProcessId = $_.OwningProcess
            RemoteAddress = $_.RemoteAddress
            RemotePort = $_.RemotePort
            State = $_.State
        }
    }
}

if ($HighPortConnections) {
    Write-Host "[!] ALERT: SSH connections on high ports detected:" -ForegroundColor Red
    $HighPortConnections | Format-Table -AutoSize
}

# Check Cursor extensions directory for recently modified or suspicious extensions
$CursorExtensionsPath = "$env:USERPROFILE\.cursor\extensions"
if (Test-Path $CursorExtensionsPath) {
    Write-Host "[+] Scanning Cursor extensions directory: $CursorExtensionsPath" -ForegroundColor Cyan
    
    $SuspiciousExtensions = Get-ChildItem -Path $CursorExtensionsPath -Recurse -Filter "package.json" | 
        ForEach-Object {
            $PackageJson = Get-Content $_.FullName -Raw | ConvertFrom-Json
            $ExtensionDir = $_.DirectoryName
            
            # Check for extensions with suspicious keywords or recent modifications
            if ($PackageJson.name -match "claude|anthropic" -and $PackageJson.publisher -ne "anthropic") {
                [PSCustomObject]@{
                    Name = $PackageJson.name
                    Publisher = $PackageJson.publisher
                    Version = $PackageJson.version
                    Path = $ExtensionDir
                    LastWriteTime = (Get-Item $ExtensionDir).LastWriteTime
                }
            }
        }
    
    if ($SuspiciousExtensions) {
        Write-Host "[!] ALERT: Potentially malicious Claude-related extensions found:" -ForegroundColor Red
        $SuspiciousExtensions | Format-Table -AutoSize
        
        Write-Host "[?] Recommended action: Remove these extensions immediately and audit for compromise" -ForegroundColor Yellow
    }
}

# Check for recently created scheduled tasks or persistence mechanisms
$RecentTasks = Get-ScheduledTask | Where-Object {
    ($_.Date -gt (Get-Date).AddDays(-7)) -and
    ($_.TaskName -match "ssh|tunnel|update")
}

if ($RecentTasks) {
    Write-Host "[!] Recently created suspicious scheduled tasks:" -ForegroundColor Yellow
    $RecentTasks | Select-Object TaskName, Date, TaskPath | Format-Table -AutoSize
}

Write-Host "[+] Scan complete. Review any alerts above and investigate affected systems for compromise." -ForegroundColor Green

#!/bin/bash
# Cursor Supply Chain Compromise Detection Script for Linux/macOS

echo "[+] Scanning for reverse SSH tunnels and malicious Cursor extensions..."

# Check for SSH processes with tunneling flags
echo "[+] Checking for SSH tunneling processes..."
ps aux | grep -E "ssh.*-[RLD]" | grep -v grep | while read line; do
    echo "[!] ALERT: Suspicious SSH process detected:"
    echo "    $line"
    # Optional: kill -9 $(echo $line | awk '{print $2}')
done

# Check for established SSH connections on high ports
echo "[+] Checking for SSH connections on non-standard ports..."
if command -v ss &> /dev/null; then
    ss -tunap | grep -E ":1[0-9]{4}" | grep ssh
elif command -v netstat &> /dev/null; then
    netstat -tunap 2>/dev/null | grep -E ":1[0-9]{4}" | grep ssh
fi

# Check Cursor extensions directory
CURSOR_EXT_DIR="$HOME/.cursor/extensions"
if [ -d "$CURSOR_EXT_DIR" ]; then
    echo "[+] Scanning Cursor extensions in $CURSOR_EXT_DIR"
    
    find "$CURSOR_EXT_DIR" -name "package.json" -mtime -30 | while read pkg; do
        # Check for unofficial Claude extensions
        if grep -q "claude" "$pkg" && ! grep -q '"publisher": "anthropic"' "$pkg"; then
            echo "[!] ALERT: Suspicious Claude extension found:"
            echo "    Path: $(dirname $pkg)"
            echo "    Package: $(grep '"name"' "$pkg" | cut -d'"' -f4)"
            echo "    Publisher: $(grep '"publisher"' "$pkg" | cut -d'"' -f4)"
        fi
    done
fi

# Check for recent SSH key modifications or new authorized_keys
echo "[+] Checking SSH configuration for unauthorized modifications..."
find ~/.ssh -name "authorized_keys" -o -name "*.pub" -mtime -7 | while read keyfile; do
    echo "[!] Recently modified SSH file: $keyfile"
    ls -la "$keyfile"
done

# Check for persistence mechanisms in cron
echo "[+] Checking for suspicious cron jobs..."
crontab -l 2>/dev/null | grep -E "ssh|curl|wget|nc|bash" | while read cron; do
    echo "[!] Suspicious cron entry: $cron"
done

echo "[+] Scan complete. If any alerts were generated, isolate the system and perform forensic analysis."