Anthropic被黑，可以向世界各地的Claude开发者笔记本电脑提供远程访问trojan
昨天，Anthropic被泄露，千千万万开发者为Claude访问使用的Visual Studio代码和Cursor扩展正在通过SSH倒置后门发送远程访问trojan. 恶意软件允许在供应链攻击中手接和自动远程访问开发者笔记本电脑和桌面。
Anthropic没有通知客户，默默地删除了后门版本，不告诉任何人。
扩展本身在Visual Studio Code (VSCode)和Cursor更新到恶意版本。 扩建设施有4000多万个。
Phorion是第一个注意到端点恶意活动的：
失密版本为2.1.313. 这个版本在8小时前被Anthropic所取代，它没有从已经被感染的系统去掉SSH后门，也没有从之前的侦察活动中去掉。
将Kevin Beaumont的故事输入您的收件箱
加入 MED 免费从此作者获取更新。
请注意2.1.313在OpenVSX、Visual Studio Marketplace和Cursor丢失：
Cursor承认此事：
Anthropic的Claude Code扩展的恶意修改版本在Cursor VS代码扩展市场中提供。 扩展运行了恶意代码，试图安装一个持久的SSH后门。 具体而言：
收集主机和用户信息：主机名，用户名，OS，架构，家目录路径，环境变量名，工作目录，配置的Git电子邮件，以及公共IP.
尝试在授权的 keys上添加由攻击者控制的SSH密钥，启用本地SSH服务，并打开倒转的SSH隧道。 除了Cursor以管理员权限开始的非常不寻常的情况外，由于恶意代码的错误，这一步骤会失败。
试图通过一个LOUTAgent(macOS)或一个计划任务使倒转的SSH地道持续运行，该任务试图以System运行并带有起动符回落(Windows). 背景脚本大约每60秒重试一次地道。
报告主机细节和后门状态通过HTTP POST到/beacon 在8099端口。
为了与Microsoft Defense for Endpoint一起寻找恶意版本，我发布了KQL查询：
在笔记本电脑上运行Claude Code的著名客户包括比南斯等数千人。
@gossithedog@cyberplace. 社会：
本文由 AI宝库自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Anthropic hacked to deliver remote access trojan to Claude developer laptops worldwide
Yesterday, Anthropic were compromised and a Visual Studio Code and Cursor extension used by tens of millions of developers for Claude access was delivering a remote access trojan via an SSH reverse backdoor. The malware allowed hands on and automated remote access to developer laptops and desktops, in a supply chain attack.
Anthropic has not informed customers, and silently deleted the backdoored version without telling anybody.
The extension itself auto updated in Visual Studio Code (VSCode) and Cursor to the malicious version. The extension has over 40 million installations.
Phorion were the first to notice the malicious activity on endpoints:
The compromised version was 2.1.313. This version was replaced 8 hours ago by Anthropic, with version 2.1.314, which appears to remove the backdoor from the extension but I’m not sure if it still contains no malicious code. It does not remove the SSH backdoor from systems already infected, nor the prior recon activity.
Get Kevin Beaumont’s stories in your inbox
Join Medium for free to get updates from this writer.
You may notice 2.1.313 is missing from OpenVSX, Visual Studio Marketplace and Cursor:
Cursor has admitted the issue:
a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code extension Marketplace. The extension runs malicious code that attempts to install a persistent SSH backdoor. Specifically, it:
Collects host and user information: hostname, username, OS, architecture, home directory path, environment variable names, working directories, configured Git email, and public IP.
Attempts to add an attacker-controlled SSH key to authorized_keys, enable the local SSH service, and open a reverse SSH tunnel. Outside of highly unusual circumstances where Cursor was started with administrator privileges, due to errors in the malicious code, this step would fail.
Attempts to make the reverse SSH tunnel persistent via a LaunchAgent (macOS) or a scheduled task that attempts to run as SYSTEM with a Startup-script fallback (Windows). Background scripts retry the tunnel roughly every 60 seconds.
Reports host details and backdoor status via HTTP POST to /beacon on port 8099.
To hunt for the malicious version with Microsoft Defender for Endpoint, I have published KQL queries:
Notable customers who run Claude Code on laptops include Binance, amongst thousands of others.
This is an emerging situation, follow me on Mastodon for updates — @gossithedog@cyberplace.social:
Auto-fetched and translated by AI Gem Box. All rights belong to the original author.