Phorion details Claude Code extension compromise and cleanup steps
The point
Phorion found a persistent SSH backdoor in the official Claude Code for VS Code extension 2.1.313 on the Cursor Marketplace. Cursor removed that release. The malware adds an attacker key, opens a reverse tunnel, and installs persistence across macOS, Linux, and Windows.
Why it matters
Builders on 2.1.313 need incident response and full cleanup, not just an update.
Key details
- Planted key comment is svc-telemetry in ~/.ssh/authorized_keys
- Persistence includes macOS LaunchAgent com.apple.sysmond.plist and Linux @reboot cron
- Phorion says uninstalling alone will not remove the backdoor
Original ~12 min → 25 sec here Source: Phorion, Oct 30, 2026