claude-code-backdoor-check

Read-only scanner and detection rules for the trojanized [email protected] extension.

[!WARNING] The Cursor marketplace served a build not published by Anthropic on 2026-10-29, 09:27–20:35 UTC. It plants an SSH key and persistence, then opens a reverse tunnel to 134.209.82[.]225. Updating to 2.1.314 removes the extension, not what it planted.

_{Independent community tool by HappyHackingSpace. Not affiliated with Anthropic or Cursor.}

Contents: Quick start · What it checks · Detection rules · If you get a hit · Block the C2 · IOCs · References

Quick start

git clone https://github.com/happyhackingspace/claude-code-backdoor-check.git
cd claude-code-backdoor-check
bash check.sh           # fast scan
bash check.sh --deep    # + sshd log analysis (slower on macOS)

• One bash file, read-only: no sudo, no network, no writes.
• Runs on macOS (bash 3.2+) and Linux.
• Exit codes: 0 clean · 1 indicators found · 2 usage error.

Verdicts

What it checks

[!NOTE] com.apple.sysmond is also a real Apple system daemon. Only the copy in the user domain (~/Library/LaunchAgents) is malicious.

Detection rules

For EDR/SIEM pipelines and fleet-wide hunting. Unlike the rest of this README, the rule files contain the C2 un-defanged, because they have to match it.

Sigma (rules/sigma/)

pip install sigma-cli
sigma plugin install splunk                     # or elasticsearch, microsoft365defender, …
sigma convert -t splunk --without-pipeline rules/sigma/

YARA (rules/yara/claude_code_backdoor.yar)

yara -r -s rules/yara/claude_code_backdoor.yar \
  ~/.cursor/extensions ~/.vscode/extensions ~/.config ~/.ssh ~/Library/LaunchAgents

[!TIP] The Sigma rules also cover Windows (scheduled task, OpenSSH install), which check.sh does not.

If you get a hit

[!CAUTION] The persistence re-opens the tunnel about every 60 seconds. Contain first, then clean up. Cursor also ships official remediation scripts: see its security notice.

1. Contain. Take the machine offline, or block the C2.

2. Preserve evidence before deleting anything:

mkdir -p ~/ioc-evidence && cd ~/ioc-evidence
bash /path/to/check.sh --deep --no-color > scan.txt
cp -p ~/.ssh/authorized_keys ~/.ssh/known_hosts ~/.config/.smt ~/.config/.smtk . 2>/dev/null

[!IMPORTANT] .smtk is the attacker's private tunnel key. Keep the evidence folder private.

3. Clean up. Remove the persistence, kill the tunnel, delete the artifacts:

C2="$(echo '134.209.82[.]225' | tr -d '[]')"

launchctl bootout gui/$(id -u)/com.apple.sysmond
rm -f ~/Library/LaunchAgents/com.apple.sysmond.plist
pkill -f "tunnel@$C2"; pkill -f 'autossh -M 0'; pkill -f '\.config/\.smt'
sed -i.bak '/svc-telemetry/d' ~/.ssh/authorized_keys
ssh-keygen -R "$C2"
rm -f ~/.config/.smt ~/.config/.smtk "$TMPDIR"/.stk_*
sudo systemsetup -setremotelogin off      # if you don't use SSH

crontab -l | grep -vE '\.config/\.smt|tunnel@' | crontab -
# disable and remove any systemd/autostart entries check.sh reported
pkill -f "tunnel@$C2"; pkill -f 'autossh -M 0'; pkill -f '\.config/\.smt'
sed -i.bak '/svc-telemetry/d' ~/.ssh/authorized_keys
ssh-keygen -R "$C2"
rm -f ~/.config/.smt ~/.config/.smtk /tmp/.stk_* /var/tmp/.stk_*
sudo systemctl disable --now ssh          # if you don't use SSH

4. Replace the extension. Remove anthropic.claude-code-2.1.313* and install ≥ 2.1.314.

5. Verify. bash check.sh --deep should exit 0.

6. Rotate credentials from a different, clean machine: SSH keys, git tokens, cloud and API keys, registry tokens. Start with the list under [9/9].

7. Rebuild the machine if the C2 is in known_hosts or sshd accepted the attacker key.

Exposed but clean?

Run with --deep. Rotate at least the secrets listed under [9/9], because their names were beaconed. Keep the C2 blocked.

Block the C2

The implant connects to the IP directly, so DNS filters (NextDNS, Pi-hole) never see it. Block it at the firewall:

IOCs