Malicious Claude Code Extension in Cursor Marketplace Installs SSH Backdoor — Detection and Remediation Guide

---
title: Suspicious SSH Authorized Keys Modification
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects modification of SSH authorized_keys files, a common persistence mechanism used in this attack to enable unauthorized remote access.
references:
  - https://attack.mitre.org/techniques/T1098/004/
  - https://www.bleepingcomputer.com/news/security/malicious-claude-code-extension-on-cursor-planted-ssh-backdoors/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1098.004
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
      - '/.ssh/authorized_keys'
      - '/.ssh/authorized_keys2'
  filter_known_editors:
    Image|endswith:
      - '/vim'
      - '/nano'
      - '/emacs'
      - '/code'
  condition: selection and not filter_known_editors
falsepositives:
  - Legitimate DevOps automation adding keys
  - Configuration management tools (Ansible, Puppet)
level: high
---
title: SSH Server Installation or Configuration Change on Workstation
id: 9d4c3b2a-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects installation of SSH server packages or modification of sshd_config, which may indicate backdoor installation on a developer workstation.
references:
  - https://attack.mitre.org/techniques/T1133/
  - https://www.bleepingcomputer.com/news/security/malicious-claude-code-extension-on-cursor-planted-ssh-backdoors/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1133
logsource:
  category: process_creation
  product: linux
detection:
  selection_install:
    CommandLine|contains:
      - 'apt-get install openssh-server'
      - 'apt install openssh-server'
      - 'yum install openssh-server'
      - 'dnf install openssh-server'
      - 'brew install openssh'
  selection_config:
    CommandLine|contains:
      - 'sshd_config'
  condition: selection_install or selection_config
falsepositives:
  - Legitimate system administration
level: medium
---
title: VS Code Extension Spawning Shell or Network Tool
id: 7e2d1c0b-4a5f-6e7d-8c9b-0a1f2e3d4c5b
status: experimental
description: Detects VS Code or Cursor extension host processes spawning suspicious child processes such as shells or network utilities, which may indicate malicious extension activity.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://www.bleepingcomputer.com/news/security/malicious-claude-code-extension-on-cursor-planted-ssh-backdoors/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\\Cursor.exe'
      - '\\Code.exe'
  selection_child:
    Image|endswith:
      - '\\powershell.exe'
      - '\\cmd.exe'
      - '\\wscript.exe'
      - '\\cscript.exe'
      - '\\mshta.exe'
      - '\\curl.exe'
      - '\\wget.exe'
      - '\\ssh.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate extensions that execute shell commands (e.g., integrated terminal)
  - Build tools and task runners
level: medium

// Hunt for SSH authorized_keys modifications on Windows and Linux endpoints
DeviceFileEvents
| where TimeGenerated > ago(30d)
| where FileName contains "authorized_keys"
| where InitiatingProcessFileName !in~ ("code.exe", "cursor.exe", "vim", "nano", "emacs")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath, ActionType
| order by TimeGenerated desc

// Hunt for VS Code or Cursor spawning suspicious child processes
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName in~ ("code.exe", "cursor.exe", "code", "cursor")
| where FileName in~ ("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe", "curl.exe", "wget.exe", "ssh.exe", "bash", "sh")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by TimeGenerated desc

// Hunt for SSH server installation or unexpected SSH daemon execution
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where ProcessCommandLine has_any ("openssh-server", "sshd", "dropbear")
| where InitiatingProcessFileName in~ ("apt", "apt-get", "yum", "dnf", "brew", "powershell.exe", "bash", "sh")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, ProcessCommandLine, FileName
| order by TimeGenerated desc

// Hunt for outbound SSH connections from developer workstations to unexpected destinations
DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemotePort == 22
| where InitiatingProcessFileName in~ ("ssh.exe", "sshd.exe", "ssh", "sshd")
| where RemoteIP !startswith "10." and RemoteIP !startswith "192.168." and RemoteIP !startswith "172.16."
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl
| order by TimeGenerated desc

-- Hunt for SSH authorized_keys files modified in the last 30 days
SELECT FullPath, Mtime, Size, Data.Attributes AS Attributes
FROM glob(globs="/**/.ssh/authorized_keys*")
WHERE Mtime > (now() - 30 * 24 * 60 * 60)
ORDER BY Mtime DESC

-- Hunt for processes with SSH-related command lines spawned by editors
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(ssh|sshd|authorized_keys|openssh)'
  AND (Exe =~ '(code|cursor)' OR Name =~ '(code|cursor)')

-- Hunt for active SSH connections from developer workstations
SELECT Pid, Name, RemoteAddr, RemotePort, State, Exe
FROM netstat()
WHERE RemotePort == 22
  AND State == 'ESTABLISHED'
  AND (Exe =~ '(code|cursor|ssh|sshd)')

# PowerShell script for Windows workstations
# Checks for suspicious SSH authorized_keys, unexpected OpenSSH Server, and Cursor extension anomalies

Write-Host "=== Security Arsenal: Malicious Extension Remediation Check ===" -ForegroundColor Cyan

# 1. Check for SSH authorized_keys files and recent modifications
Write-Host "`n[1] Checking for SSH authorized_keys files..." -ForegroundColor Yellow
$sshPaths = @("$env:USERPROFILE\.ssh\authorized_keys", "$env:USERPROFILE\.ssh\authorized_keys2")
foreach ($path in $sshPaths) {
    if (Test-Path $path) {
        $fileInfo = Get-Item $path
        Write-Host "  Found: $path" -ForegroundColor Red
        Write-Host "    Last Modified: $($fileInfo.LastWriteTime)" -ForegroundColor Red
        Write-Host "    Contents:" -ForegroundColor Red
        Get-Content $path | ForEach-Object { Write-Host "      $_" -ForegroundColor Red }
        Write-Host "  ACTION REQUIRED: Review and remove unauthorized keys." -ForegroundColor Red
    } else {
        Write-Host "  Not found (expected on most Windows workstations): $path" -ForegroundColor Green
    }
}

# 2. Check if OpenSSH Server is installed and running
Write-Host "`n[2] Checking for OpenSSH Server installation..." -ForegroundColor Yellow
$sshService = Get-Service -Name sshd -ErrorAction SilentlyContinue
if ($sshService) {
    Write-Host "  OpenSSH Server is installed. Status: $($sshService.Status)" -ForegroundColor Red
    if ($sshService.Status -eq 'Running') {
        Write-Host "  WARNING: SSH server is running. Verify this is intentional." -ForegroundColor Red
        Write-Host "  To stop: Stop-Service sshd; Set-Service sshd -StartupType Disabled" -ForegroundColor Yellow
    }
} else {
    Write-Host "  OpenSSH Server not installed." -ForegroundColor Green
}

# 3. Check for recently modified Cursor extensions
Write-Host "`n[3] Checking Cursor extensions directory for recent modifications..." -ForegroundColor Yellow
$cursorExtPath = "$env:USERPROFILE\.cursor\extensions"
if (Test-Path $cursorExtPath) {
    $recentExts = Get-ChildItem $cursorExtPath -Directory | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) }
    if ($recentExts) {
        Write-Host "  Recently modified extensions (last 30 days):" -ForegroundColor Yellow
        foreach ($ext in $recentExts) {
            Write-Host "    $($ext.Name) - Modified: $($ext.LastWriteTime)" -ForegroundColor Yellow
        }
        Write-Host "  ACTION: Review installed extensions in Cursor and remove any unrecognized or suspicious entries." -ForegroundColor Yellow
    } else {
        Write-Host "  No recently modified extensions found." -ForegroundColor Green
    }
} else {
    Write-Host "  Cursor extensions directory not found. Cursor may not be installed." -ForegroundColor Green
}

# 4. Check for outbound SSH connections
Write-Host "`n[4] Checking for active outbound SSH connections..." -ForegroundColor Yellow
$sshConns = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | Where-Object { $_.RemotePort -eq 22 }
if ($sshConns) {
    Write-Host "  Active SSH connections detected:" -ForegroundColor Red
    foreach ($conn in $sshConns) {
        $proc = Get-Process -Id $conn.OwningProcess -ErrorAction SilentlyContinue
        Write-Host "    Remote: $($conn.RemoteAddress):$($conn.RemotePort) | Process: $($proc.ProcessName) (PID: $($conn.OwningProcess))" -ForegroundColor Red
    }
    Write-Host "  ACTION: Verify these connections are legitimate." -ForegroundColor Red
} else {
    Write-Host "  No active outbound SSH connections." -ForegroundColor Green
}

Write-Host "`n=== Check Complete ===" -ForegroundColor Cyan
Write-Host "If any red flags were raised, isolate the workstation and begin incident response procedures." -ForegroundColor Yellow

#!/bin/bash
# Bash script for Linux and macOS workstations
# Checks for suspicious SSH authorized_keys, unexpected SSH server installations, and Cursor extension anomalies

echo "=== Security Arsenal: Malicious Extension Remediation Check ==="

# 1. Check for SSH authorized_keys files and recent modifications
echo ""
echo "[1] Checking for SSH authorized_keys files..."
for user_home in /home/* /Users/* /root; do
    if [ -d "$user_home/.ssh" ]; then
        for keyfile in "$user_home/.ssh/authorized_keys" "$user_home/.ssh/authorized_keys2"; do
            if [ -f "$keyfile" ]; then
                echo "  Found: $keyfile"
                echo "    Last Modified: $(stat -c '%y' "$keyfile" 2>/dev/null || stat -f '%Sm' "$keyfile")"
                echo "    Contents:"
                cat "$keyfile" | while read line; do echo "      $line"; done
                echo "  ACTION REQUIRED: Review and remove unauthorized keys."
            fi
        done
    fi
done

# 2. Check if SSH server is running
echo ""
echo "[2] Checking for SSH server process..."
if pgrep -x "sshd" > /dev/null || pgrep -x "dropbear" > /dev/null; then
    echo "  WARNING: SSH server is running."
    ps aux | grep -E '(sshd|dropbear)' | grep -v grep
    echo "  ACTION: Verify this is intentional. If not, stop and disable the service."
else
    echo "  No SSH server process detected."
fi

# 3. Check for recently modified Cursor extensions
echo ""
echo "[3] Checking Cursor extensions directory for recent modifications..."
CURSOR_EXT_PATH="$HOME/.cursor/extensions"
if [ -d "$CURSOR_EXT_PATH" ]; then
    RECENT_EXTS=$(find "$CURSOR_EXT_PATH" -maxdepth 1 -type d -mtime -30 2>/dev/null)
    if [ -n "$RECENT_EXTS" ]; then
        echo "  Recently modified extensions (last 30 days):"
        echo "$RECENT_EXTS" | while read ext; do
            echo "    $(basename "$ext") - Modified: $(stat -c '%y' "$ext" 2>/dev/null || stat -f '%Sm' "$ext")"
        done
        echo "  ACTION: Review installed extensions in Cursor and remove any unrecognized or suspicious entries."
    else
        echo "  No recently modified extensions found."
    fi
else
    echo "  Cursor extensions directory not found. Cursor may not be installed."
fi

# 4. Check for outbound SSH connections
echo ""
echo "[4] Checking for active outbound SSH connections..."
SSH_CONNS=$(netstat -tnp 2>/dev/null | grep ':22 ' | grep ESTABLISHED || ss -tnp | grep ':22 ' | grep ESTAB)
if [ -n "$SSH_CONNS" ]; then
    echo "  Active SSH connections detected:"
    echo "$SSH_CONNS"
    echo "  ACTION: Verify these connections are legitimate."
else
    echo "  No active outbound SSH connections."
fi

echo ""
echo "=== Check Complete ==="
echo "If any red flags were raised, isolate the workstation and begin incident response procedures."