---
title: Hunt: Microsoft's KQL queries, hashes and Defender detections for the trojanized Claude Code 2.1.312/2.1.313 extension from the Cursor marketplace | ctxsec
url: https://ctxsec.com/items/hunt-microsoft-kql-cursor-claude-code-extension-backdoor
description: ""
status: "vendor threat intel (Microsoft Threat Intelligence, Oct 30)"
published: 2026-10-30
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-microsoft-kql-cursor-claude-code-extension-backdoor.md)

vendor threat intel (Microsoft Threat Intelligence, Oct 30)

2026-10-30

### Hunt: Microsoft's KQL queries, hashes and Defender detections for the trojanized Claude Code 2.1.312/2.1.313 extension from the Cursor marketplace

Microsoft Threat Intelligence analyzed the injected loader in the tampered `anthropic.claude-code` builds (**2.1.312 and 2.1.313**) served by the Cursor marketplace on Oct 29. It confirmed that the Visual Studio Marketplace and the official npm package were not affected. New details beyond [Cursor's IOCs](/hunting#hunt-cursor-claude-code-2-1-313-svc-telemetry-iocs):

- **Recon:** the loader sends the _names_ (not values) of up to 40 environment variables containing KEY, TOKEN, SECRET, PASS, AWS or GCP, plus hostname, user and global Git email.
- **Hashes:** JavaScript entry point `ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15`; decoded tunnel private key `7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278`.
- **Windows:** also check `C:\ProgramData\ssh\administrators_authorized_keys`; the SysMon task requests SYSTEM.
- **Defender names:** Trojan:MacOS/SmtShellMal.A, Trojan:JS/CredTheft.MS!MTB, Trojan:MacOS/MalPlistSysmond.A, HackTool:MacOS/RevAnthShell.A.

**Queries:** `DeviceNetworkEvents | where RemoteIP == "134.209.82.225"`; `DeviceFileEvents` for the SHA-256 or file names `.smt`, `.smtk`, `smt.cmd`, `smtk`, `sysmon.cmd`, `com.apple.sysmond.plist` and the `.stk_` prefix; `DeviceEvents` with ActionType ScheduledTaskCreated where AdditionalFields has both "SysMon" and "smt". ATT&CK: T1098.004, T1572, T1053.003, T1053.005.

Microsoft notes that a running tunnel or a file artifact alone doesn't prove the attacker got access. Preserve evidence before you clean up.

Sources: [Microsoft Security Blog: Inside a malicious Claude Code-branded extension and its persistent SSH backdoor (Oct 30)](https://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/)