[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Threat Hunting · markdown

official IOCs (Cursor security notice); behavior details from OpenSourceMalware analysis

Hunt: the trojanized Claude Code 2.1.313 extension (Cursor marketplace, Oct 29): svc-telemetry key, com.apple.sysmond LaunchAgent, SysMon task, reverse tunnel to 134.209.82.225

Indicators published by Cursor for the malicious Anthropic.claude-code 2.1.313 build installed from the Cursor marketplace between 5:27 AM and 4:35 PM ET on Oct 29.

  • Network: 134.209.82[.]225 (reverse SSH as tunnel@ on TCP 22; HTTP POST to :8099/beacon); local POST attempt to 127.0.0.1:8099/beacon. Lookups to ifconfig.me / api.ipify.org alone are not an indicator.
  • SSH: key comment svc-telemetry, fingerprint SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk; reverse-tunnel key fingerprint SHA256:KOAU57+ZG6u3MG4WwzPzPX2O5YEe9qdOC1Bl+6MVyDQ.
  • Files, macOS: ~/.config/.smt, ~/.config/.smtk, $TMPDIR/.stk_<10 hex>, ~/Library/LaunchAgents/com.apple.sysmond.plist (not an Apple component).
  • Files, Windows: %USERPROFILE%\.config\smt.cmd, smtk, %TEMP%\.stk_<10 hex>, scheduled task SysMon, fallback Startup\sysmon.cmd. Linux (OpenSourceMalware): same ~/.config files plus an @reboot crontab line.
  • Process: ssh -N -R '*:0:localhost:22' or autossh -M 0 with StrictHostKeyChecking=no and UserKnownHostsFile=/dev/null.
  • Package hashes (VSIX SHA-256): darwin-arm64 432ccdee3801f99e52b8fe31f69ea9870118e96ea7ef9ecabed1479621b5ab62; win32-x64 3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081. The modified extension.js contains the IP and the string svc-telemetry.

Hunt ideas: EDR search for outbound SSH from developer laptops to a single external IP, new LaunchAgents or scheduled tasks created by an editor process tree, and writes to authorized_keys by Node/Electron processes. Check extension inventories for anthropic.claude-code-2.1.313 folders under ~/.cursor/extensions.

Sources: Cursor: Security notice, malicious Anthropic.claude-code 2.1.313 in the Cursor Extension Marketplace (Oct 29) · OpenSourceMalware: Trojanized Claude Code extension plants an SSH backdoor (updated: origin is the Cursor Marketplace, not Open VSX)