Claude Code incident: a negative SSH-key check does not rule out past payload execution

Measurement technique

How to read this report

1. 01Statically compare the supplied snapshots of Cursor’s incident notice, Phorion’s technical advisory, StepSecurity’s analysis and Kevin Beaumont’s public KQL. No payload, quick check, remediation script or hunting query was executed.
2. 02Plan an evidence_matrix with rows for each check and columns for source, platform and user scope, required evidence or telemetry, supported positive interpretation, supported negative interpretation and unresolved conditions. Do not assign detection-effectiveness scores.
3. 03Package exposure row: distinguish a matching malicious package hash from a version-string lead. Possession identifies the artifact; installation establishes exposure. Phorion and StepSecurity identify extension.js loading as the execution trigger, which installation alone does not establish.
4. 04SSH-key row: record that Cursor’s macOS check covers the current user’s authorized_keys, while Windows also checks administrators_authorized_keys. A negative result means no successful comment match in those paths. The macOS command also routes a grep error into the negative message. Phorion recommends fingerprint verification; a verified attacker key establishes an unauthorized authentication artifact, not a successful login.
5. 05Persistence row: distinguish a filename lead from verified malicious script content and registration through a macOS LaunchAgent, Windows SysMon task or Startup fallback, or Linux reboot cron entry. Installed persistence does not establish successful execution after reboot.
6. 06Network and access row: Beaumont’s attacker-IP query identifies recorded network events without filtering connection outcome. A verified tunnel still does not establish operator login. Phorion identifies successful localhost-origin SSH authentication using the planted key as follow-on access evidence.
7. 07Hunting row: document dependencies on DeviceNetworkEvents, DeviceProcessEvents, DeviceFileEvents and DeviceRegistryEvents. Separate broad version-string selectors from corroborated package evidence, and record the SSH query’s immediate-IDE-parent restriction. Zero results establish only no matching records in the queried telemetry.
8. 08Remediation row: separate Cursor’s stated remaining-artifact exit-status contract from historical compromise assessment. Attribute StepSecurity’s rebuild recommendation after a connected tunnel as precautionary guidance, not proof of authentication.