{
  "Event": {
    "uuid": "ea62b1c0-0102-4834-8149-f160ceb6509f",
    "info": "Claude Code Extension: The Update Was the Backdoor — Optimus Labs · Civilizations",
    "date": "2026-10-29",
    "threat_level_id": "1",
    "analysis": "2",
    "published": true,
    "Orgc": {
      "name": "Optimus Labs · Civilizations"
    },
    "Tag": [
      {
        "name": "optimus:briefing=\"claude-code-extension-cursor-marketplace-backdoor\""
      },
      {
        "name": "optimus:severity=\"high\""
      },
      {
        "name": "optimus:type=\"plugin\""
      },
      {
        "name": "optimus:type=\"package\""
      },
      {
        "name": "optimus:type=\"credential\""
      },
      {
        "name": "type:OSINT"
      }
    ],
    "Attribute": [
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://optimuslabs.io/research/briefings/claude-code-extension-cursor-marketplace-backdoor",
        "comment": "Optimus Labs briefing"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://cursor.com/blog/claude-code-extension-security-notice",
        "comment": "Cursor: Security notice, malicious Anthropic.claude-code 2.1.312 and 2.1.313 (Oct 29, 2026)"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://phorion.io/blog/offical-claude-code-vsx-compromise/",
        "comment": "Phorion: Official Claude Code extension compromise, security advisory (Oct 30, 2026)"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor",
        "comment": "OpenSourceMalware: Trojanized Claude Code extension plants an SSH backdoor (Oct 30, 2026)"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/",
        "comment": "Microsoft Security: Inside a malicious Claude Code-branded extension (Oct 30, 2026)"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://www.wired.com/story/trojan-malware-targets-thousands-of-anthropic-claude-developer-systems/",
        "comment": "Wired: A supply chain attack put malicious Claude extensions on thousands of devices (Oct 30, 2026)"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://socket.dev/blog/claude-code-extension-compromise",
        "comment": "Socket: Cursor removes malicious Claude Code 2.1.313 extension (Oct 30, 2026)"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://arstechnica.com/security/2026/10/anthropic-vs-code-extension-on-cursor-backdoored-for-nearly-12-hours/",
        "comment": "Ars Technica: Anthropic VS Code extension on Cursor backdoored for nearly 12 hours (Oct 30, 2026)"
      },
      {
        "type": "link",
        "category": "External analysis",
        "to_ids": false,
        "value": "https://news.ycombinator.com/item?id=50300683",
        "comment": "Hacker News: Anthropic's Felix Rieseberg on the incident"
      },
      {
        "type": "ip-dst",
        "category": "Network activity",
        "to_ids": true,
        "value": "134.209.82.225",
        "comment": "Outbound traffic to 134.209.82.225 on ports 22 or 8099"
      },
      {
        "type": "filename",
        "category": "Payload delivery",
        "to_ids": false,
        "value": "extension.js",
        "comment": "extension.js SHA-256 starting ecb58cb2 and ending 3ab6bf15"
      }
    ]
  }
}