Malicious Claude Code Extension SSH Backdoor and Reverse Tunnel

Lacey Cochrane@NullVectorX

•updated today•3•0•15

Detects indicators of compromise associated with a trojanized Claude Code VS Code extension distributed through Cursor's marketplace. The rule identifies file modifications to authorized_keys, process executions establishing reverse SSH tunnels, specific hardcoded C2 IP addresses, and references to the attacker's SSH key 'svc-telemetry'.