Hacked Tor exits intercepted SSH logins and planted Ebury backdoors

Sat, 31 Oct 2026 00:44:52 +0100

On 5 October the Tor Project warned relay operators that hacked Linux relays had been turned into exits to intercept SSH connections. kaba.cx found them by pinning each of the roughly 3,000 exits with exitmap: 333 exits, a tenth of all exits, redirected port 22 to one of 12 interception servers. Click past the host-key warning and they steal your password, watch the session and install the Ebury OpenSSH backdoor over a second connection. One affected operator’s timeline blames one password for SSH, sudo and the backup passphrase, in cleartext in a helper script. Their Ebury 1.8.3 is newer than ESET’s public IOCs and sails past dpkg -V, because it drops its own setuid library and re-points a symlink. Marc-Etienne M. Léveillé replied that 1.8.3 has been around since at least June 2026 and, with some 400,000 servers backdoored between 2009 and 2023, more relays are most likely compromised. The new exit policies also closed IMAPS and POP3S, so mail only crossed those relays in cleartext, and it all started on a Friday morning, presumably betting on a quiet weekend.

Cursor's marketplace served a backdoored Claude Code extension

Fri, 30 Oct 2026 15:18:55 +0100

Calum Hall at Phorion found an SSH backdoor in version 2.1.313 of the Claude Code extension and reported it as an Open VSX compromise. Cursor’s notice, dated 29 October, traces it to Cursor’s marketplace instead, says Anthropic did not build that version and counts at most 5,000 users. OpenSourceMalware shows a 66-line loader prepended to extension.js that runs when the extension starts, no Claude prompt needed. It appends an Ed25519 key labelled svc-telemetry to ~/.ssh/authorized_keys, tries to switch on SSH, opens a reverse tunnel to 134.209.82.225 and persists through a LaunchAgent, an @reboot cron entry or a SysMon scheduled task. It also beacons hostname, user, Git email and the names of environment variables that smell like secrets.

Uninstalling the extension won’t remove the backdoor. If 2.1.313 ever loaded, look for the svc-telemetry key, isolate the host, run Cursor’s remediation scripts and rotate every credential the account could reach, from a clean machine. Cursor asks all users to update to 2.1.314. OpenSourceMalware recommends rebuilding the host, sensible for a laptop that may have offered port 22 to a stranger.

Between about 2:27am PT and 1:35pm PT today, a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code extension Marketplace.

— cursor.com

Malware on Christoph Kemetmüller

Hacked Tor exits intercepted SSH logins and planted Ebury backdoors

Cursor's marketplace served a backdoored Claude Code extension