MONDOO-ADV-2026-hkmio

Version 2.1.313 of the Claude Code for VS Code extension (Anthropic.claude-code) was published in late October 2026 with a malicious loader prepended to the bundled extension.js. The loader runs as soon as a VS Code-based editor (VS Code, Cursor, Windsurf, VSCodium, and other Open VSX consumers) loads the extension, before the extension activates and without any user interaction. It installs a persistent SSH backdoor on macOS, Linux, and Windows. The release was confirmed on the Open VSX registry and has since been removed. Version 2.1.314 replaces it, and 2.1.312 and 2.1.314 are not affected.

Mitigation

Uninstalling or updating the extension does not remove the backdoor. On every machine that had version 2.1.313 installed:

1. Update the extension to 2.1.314 or later.
2. Stop the tunnel. Kill any ssh or autossh process connecting to 134.209.82.225 and the /bin/sh retry loop that restarts it.
3. Remove persistence:
   • macOS: unload and delete ~/Library/LaunchAgents/com.apple.sysmond.plist.
   • Linux: remove the @reboot crontab entry that runs ~/.config/.smt, and check that your other cron jobs are still present.
   • Windows: delete the SysMon scheduled task and %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd.
   • All platforms: delete ~/.config/.smt, ~/.config/.smtk, ~/.config/smt.cmd, ~/.config/smtk, and any .stk_* file in the system temp directory.
4. Clean SSH access. Remove the key with the comment svc-telemetry from ~/.ssh/authorized_keys, and turn off Remote Login or the SSH server if you did not enable it yourself.
5. Treat the host as compromised if the tunnel ran. Review SSH logs for logins from 127.0.0.1 or ::1 using the svc-telemetry key, and rotate every credential the user could reach, especially those stored in environment variables whose names contain KEY, TOKEN, SECRET, PASS, AWS, or GCP.

What the malware...