---
title: Hunt: the trojanized Claude Code 2.1.313 extension (Cursor marketplace, Oct 29): svc-telemetry key, com.apple.sysmond LaunchAgent, SysMon task, reverse tunnel to 134.209.82.225 | ctxsec
url: https://ctxsec.com/items/hunt-cursor-claude-code-2-1-313-svc-telemetry-iocs
description: ""
status: "official IOCs (Cursor security notice); behavior details from OpenSourceMalware analysis"
published: 2026-10-30
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-cursor-claude-code-2-1-313-svc-telemetry-iocs.md)

official IOCs (Cursor security notice); behavior details from OpenSourceMalware analysis

2026-10-30

### Hunt: the trojanized Claude Code 2.1.313 extension (Cursor marketplace, Oct 29): svc-telemetry key, com.apple.sysmond LaunchAgent, SysMon task, reverse tunnel to 134.209.82.225

Indicators published by Cursor for the malicious `Anthropic.claude-code` 2.1.313 build installed from the Cursor marketplace between 5:27 AM and 4:35 PM ET on Oct 29.

- **Network:** 134.209.82[.]225 (reverse SSH as `tunnel@` on TCP 22; HTTP POST to `:8099/beacon`); local POST attempt to 127.0.0.1:8099/beacon. Lookups to ifconfig.me / api.ipify.org alone are not an indicator.
- **SSH:** key comment `svc-telemetry`, fingerprint SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk; reverse-tunnel key fingerprint SHA256:KOAU57+ZG6u3MG4WwzPzPX2O5YEe9qdOC1Bl+6MVyDQ.
- **Files, macOS:** `~/.config/.smt`, `~/.config/.smtk`, `$TMPDIR/.stk_<10 hex>`, `~/Library/LaunchAgents/com.apple.sysmond.plist` (not an Apple component).
- **Files, Windows:** `%USERPROFILE%\.config\smt.cmd`, `smtk`, `%TEMP%\.stk_<10 hex>`, scheduled task `SysMon`, fallback `Startup\sysmon.cmd`. **Linux** (OpenSourceMalware): same `~/.config` files plus an `@reboot` crontab line.
- **Process:** `ssh -N -R '*:0:localhost:22'` or `autossh -M 0` with `StrictHostKeyChecking=no` and `UserKnownHostsFile=/dev/null`.
- **Package hashes (VSIX SHA-256):** darwin-arm64 432ccdee3801f99e52b8fe31f69ea9870118e96ea7ef9ecabed1479621b5ab62; win32-x64 3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081. The modified `extension.js` contains the IP and the string svc-telemetry.

**Hunt ideas:** EDR search for outbound SSH from developer laptops to a single external IP, new LaunchAgents or scheduled tasks created by an editor process tree, and writes to `authorized_keys` by Node/Electron processes. Check extension inventories for `anthropic.claude-code-2.1.313` folders under `~/.cursor/extensions`.

Sources: [Cursor: Security notice, malicious Anthropic.claude-code 2.1.313 in the Cursor Extension Marketplace (Oct 29)](https://cursor.com/blog/claude-code-extension-security-notice) · [OpenSourceMalware: Trojanized Claude Code extension plants an SSH backdoor (updated: origin is the Cursor Marketplace, not Open VSX)](https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor)