{"id":2171,"date":"2026-10-31T07:17:43","date_gmt":"2026-10-31T00:17:43","guid":{"rendered":"https:\/\/vncybers.vn\/hieu-claude-code-cursor-cua-hau-ssh-nha-phat-trien-can-lam-gi\/"},"modified":"2026-10-31T07:17:43","modified_gmt":"2026-10-31T00:17:43","slug":"understanding-claude-code-cursor-ssh-backdoor-what-developers-should-do","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/hieu-claude-code-cursor-cua-hau-ssh-nha-phat-trien-can-lam-gi\/","title":{"rendered":"Understanding the Cursor Claude Code SSH Backdoor: What Developers Should Do"},"content":{"rendered":"

M\u1ed9t phi\u00ean b\u1ea3n \u0111\u1ed9c h\u1ea1i c\u1ee7a ti\u1ec7n \u00edch Claude Code \u0111\u00e3 xu\u1ea5t hi\u1ec7n tr\u00ean Cursor VS Code Extension Marketplace trong kho\u1ea3ng 11 gi\u1edd ng\u00e0y 29\/10\/2026. S\u1ef1 c\u1ed1 cho th\u1ea5y m\u1ed9t g\u00f3i c\u00f3 giao di\u1ec7n v\u00e0 ch\u1ee9c n\u0103ng h\u1ee3p l\u1ec7 v\u1eabn c\u00f3 th\u1ec3 tr\u1edf th\u00e0nh \u0111\u01b0\u1eddng v\u00e0o m\u00e1y tr\u1ea1m ph\u00e1t tri\u1ec3n n\u1ebfu m\u00e3 \u0111\u1ed9c \u0111\u01b0\u1ee3c ch\u00e8n v\u00e0o chu\u1ed7i ph\u00e2n ph\u1ed1i.<\/p>\n

\"Th\u00f4ng
Cursor c\u00f4ng b\u1ed1 th\u00f4ng b\u00e1o b\u1ea3o m\u1eadt v\u00e0 h\u01b0\u1edbng d\u1eabn x\u1eed l\u00fd cho ng\u01b0\u1eddi d\u00f9ng b\u1ecb \u1ea3nh h\u01b0\u1edfng. Ngu\u1ed3n: Cursor.<\/figcaption><\/figure>\n

\u0110i\u1ec1u g\u00ec \u0111\u00e3 x\u1ea3y ra?<\/h2>\n

Theo th\u00f4ng b\u00e1o ch\u00ednh th\u1ee9c c\u1ee7a Cursor, hai b\u1ea3n Anthropic.claude-code 2.1.312 v\u00e0 2.1.313 d\u00e0nh cho Windows v\u00e0 macOS \u0111\u00e3 b\u1ecb s\u1eeda \u0111\u1ed5i \u0111\u1ed9c h\u1ea1i tr\u00ean marketplace c\u1ee7a Cursor. C\u00e1c g\u00f3i n\u00e0y \u0111\u01b0\u1ee3c ph\u00e2n ph\u1ed1i t\u1eeb kho\u1ea3ng 2:27 \u0111\u1ebfn 13:35 gi\u1edd Th\u00e1i B\u00ecnh D\u01b0\u01a1ng ng\u00e0y 29\/10. Cursor nh\u1ea5n m\u1ea1nh m\u00e3 \u0111\u1ed9c kh\u00f4ng do Anthropic ph\u00e1t tri\u1ec3n v\u00e0 ch\u01b0a c\u00f3 b\u1eb1ng ch\u1ee9ng cho th\u1ea5y c\u00e1c b\u1ea3n ch\u00ednh th\u1ee9c tr\u00ean Microsoft Visual Studio Code Marketplace, Open VSX hay g\u00f3i Claude Code tr\u00ean npm b\u1ecb \u1ea3nh h\u01b0\u1edfng.<\/p>\n

Cursor \u0111\u00e3 g\u1ee1 phi\u00ean b\u1ea3n \u0111\u1ed9c h\u1ea1i, t\u1ea1m \u0111\u00f3ng to\u00e0n b\u1ed9 marketplace \u0111\u1ec3 ki\u1ec3m tra, xoay v\u00f2ng kh\u00f3a truy c\u1eadp v\u00e0 d\u1ef1ng l\u1ea1i d\u1ecbch v\u1ee5. C\u00f4ng ty c\u0169ng ph\u1ed1i h\u1ee3p v\u1edbi nh\u00e0 cung c\u1ea5p h\u1ea1 t\u1ea7ng \u0111\u1ec3 v\u00f4 hi\u1ec7u h\u00f3a m\u00e1y ch\u1ee7 c\u1ee7a k\u1ebb t\u1ea5n c\u00f4ng.<\/p>\n

V\u00ec sao ti\u1ec7n \u00edch c\u00f3 th\u1ec3 ch\u1ea1y m\u00e3 \u0111\u1ed9c ngay khi \u0111\u01b0\u1ee3c n\u1ea1p?<\/h2>\n

Ph\u00e2n t\u00edch c\u1ee7a Phorion v\u00e0 OpenSourceMalware cho th\u1ea5y m\u1ed9t \u0111o\u1ea1n JavaScript ng\u1eafn \u0111\u01b0\u1ee3c ch\u00e8n \u1edf \u0111\u1ea7u t\u1ec7p extension.js<\/code>, tr\u01b0\u1edbc ph\u1ea7n m\u00e3 h\u1ee3p l\u1ec7. \u0110o\u1ea1n m\u00e3 n\u00e0y ch\u1ea1y khi tr\u00ecnh ch\u1ee7 n\u1ea1p ti\u1ec7n \u00edch, kh\u00f4ng c\u1ea7n ng\u01b0\u1eddi d\u00f9ng m\u1edf cu\u1ed9c tr\u00f2 chuy\u1ec7n v\u1edbi Claude Code hay th\u1ef1c hi\u1ec7n thao t\u00e1c \u0111\u1eb7c bi\u1ec7t.<\/p>\n

\u0110\u00e2y l\u00e0 \u0111i\u1ec3m r\u1ee7i ro c\u1ed1t l\u00f5i c\u1ee7a ti\u1ec7n \u00edch IDE: ch\u00fang ho\u1ea1t \u0111\u1ed9ng v\u1edbi quy\u1ec1n c\u1ee7a t\u00e0i kho\u1ea3n \u0111ang ch\u1ea1y tr\u00ecnh so\u1ea1n th\u1ea3o v\u00e0 c\u00f3 th\u1ec3 ti\u1ebfp c\u1eadn m\u00e3 ngu\u1ed3n, t\u1ec7p c\u1ea5u h\u00ecnh, kho kh\u00f3a SSH v\u00e0 bi\u1ebfn m\u00f4i tr\u01b0\u1eddng. Ch\u1eef k\u00fd th\u01b0\u01a1ng hi\u1ec7u ho\u1eb7c giao di\u1ec7n quen thu\u1ed9c kh\u00f4ng \u0111\u1ee7 \u0111\u1ec3 ch\u1ee9ng minh g\u00f3i c\u00e0i \u0111\u1eb7t an to\u00e0n.<\/p>\n

Chu\u1ed7i t\u1ea5n c\u00f4ng ho\u1ea1t \u0111\u1ed9ng nh\u01b0 th\u1ebf n\u00e0o?<\/h2>\n

Sau khi \u0111\u01b0\u1ee3c n\u1ea1p, m\u00e3 \u0111\u1ed9c thu th\u1eadp t\u00ean m\u00e1y, t\u00ean ng\u01b0\u1eddi d\u00f9ng, h\u1ec7 \u0111i\u1ec1u h\u00e0nh, ki\u1ebfn tr\u00fac CPU, th\u01b0 m\u1ee5c l\u00e0m vi\u1ec7c, email Git v\u00e0 t\u00ean c\u1ee7a m\u1ed9t s\u1ed1 bi\u1ebfn m\u00f4i tr\u01b0\u1eddng li\u00ean quan \u0111\u1ebfn kh\u00f3a, token ho\u1eb7c m\u1eadt kh\u1ea9u. Gi\u00e1 tr\u1ecb b\u00ed m\u1eadt kh\u00f4ng \u0111\u01b0\u1ee3c \u0111\u01b0a tr\u1ef1c ti\u1ebfp v\u00e0o beacon ban \u0111\u1ea7u, nh\u01b0ng danh s\u00e1ch t\u00ean bi\u1ebfn c\u00f3 th\u1ec3 gi\u00fap k\u1ebb t\u1ea5n c\u00f4ng x\u00e1c \u0111\u1ecbnh m\u00e1y ch\u1ee9a th\u00f4ng tin gi\u00e1 tr\u1ecb.<\/p>\n

M\u00e3 \u0111\u1ed9c ti\u1ebfp t\u1ee5c th\u00eam kh\u00f3a c\u00f4ng khai Ed25519 c\u00f3 nh\u00e3n svc-telemetry<\/code> v\u00e0o t\u1ec7p authorized_keys<\/code>, th\u1eed b\u1eadt d\u1ecbch v\u1ee5 SSH v\u00e0 t\u1ea1o \u0111\u01b0\u1eddng h\u1ea7m SSH ng\u01b0\u1ee3c t\u1edbi m\u00e1y ch\u1ee7 \u0111i\u1ec1u khi\u1ec3n. C\u01a1 ch\u1ebf duy tr\u00ec hi\u1ec7n di\u1ec7n \u0111\u01b0\u1ee3c c\u00e0i b\u1eb1ng LaunchAgent tr\u00ean macOS, t\u00e1c v\u1ee5 theo l\u1ecbch ho\u1eb7c th\u01b0 m\u1ee5c Startup tr\u00ean Windows; ph\u00e2n t\u00edch m\u1eabu c\u00f2n ghi nh\u1eadn nh\u00e1nh cron cho Linux.<\/p>\n

T\u1ea1i sao l\u1ed7i l\u1eadp tr\u00ecnh kh\u00f4ng \u0111\u1ed3ng ngh\u0129a v\u1edbi an to\u00e0n?<\/h2>\n

M\u1ed9t s\u1ed1 b\u01b0\u1edbc b\u1eadt SSH c\u00f3 l\u1ed7i. Tr\u00ean macOS, l\u1ec7nh ki\u1ec3m tra Remote Login c\u1ea7n quy\u1ec1n qu\u1ea3n tr\u1ecb n\u00ean m\u00e3 \u0111\u1ed9c c\u00f3 th\u1ec3 hi\u1ec3u sai tr\u1ea1ng th\u00e1i; tr\u00ean Windows, m\u1ed9t nh\u00e1nh c\u1ed1 g\u1ecdi PowerShell qua \u0111\u01b0\u1eddng d\u1eabn shell ki\u1ec3u Unix. V\u00ec v\u1eady, \u0111\u01b0\u1eddng truy c\u1eadp t\u1eeb xa c\u00f3 th\u1ec3 th\u1ea5t b\u1ea1i tr\u00ean nhi\u1ec1u m\u00e1y ch\u01b0a b\u1eadt s\u1eb5n SSH.<\/p>\n

Tuy nhi\u00ean, kh\u00f3a tr\u00e1i ph\u00e9p v\u1eabn c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c ghi, c\u01a1 ch\u1ebf duy tr\u00ec v\u1eabn \u0111\u01b0\u1ee3c t\u1ea1o v\u00e0 d\u1eef li\u1ec7u trinh s\u00e1t v\u1eabn c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c g\u1eedi \u0111i. N\u1ebfu SSH \u0111\u00e3 ho\u1ea1t \u0111\u1ed9ng ho\u1eb7c tr\u00ecnh so\u1ea1n th\u1ea3o ch\u1ea1y v\u1edbi quy\u1ec1n cao, r\u1ee7i ro truy c\u1eadp t\u01b0\u01a1ng t\u00e1c v\u1eabn hi\u1ec7n h\u1eefu. Vi\u1ec7c m\u00e1y ch\u1ee7 \u0111i\u1ec1u khi\u1ec3n \u0111\u00e3 b\u1ecb h\u1ea1 kh\u00f4ng th\u1ec3 lo\u1ea1i tr\u1eeb kh\u1ea3 n\u0103ng d\u1eef li\u1ec7u ho\u1eb7c phi\u00ean truy c\u1eadp \u0111\u00e3 ph\u00e1t sinh tr\u01b0\u1edbc \u0111\u00f3.<\/p>\n

Ai c\u1ea7n ki\u1ec3m tra ngay?<\/h2>\n

\u01afu ti\u00ean cao nh\u1ea5t l\u00e0 ng\u01b0\u1eddi \u0111\u00e3 c\u00e0i ho\u1eb7c c\u1eadp nh\u1eadt Anthropic.claude-code 2.1.312 hay 2.1.313 t\u1eeb marketplace c\u1ee7a Cursor tr\u00ean Windows ho\u1eb7c macOS trong khung th\u1eddi gian \u0111\u01b0\u1ee3c c\u00f4ng b\u1ed1. C\u00e1c t\u1ed5 ch\u1ee9c n\u00ean \u0111\u1ed1i chi\u1ebfu kho ph\u1ea7n m\u1ec1m, nh\u1eadt k\u00fd c\u00e0i ti\u1ec7n \u00edch v\u00e0 telemetry EDR thay v\u00ec ch\u1ec9 h\u1ecfi ng\u01b0\u1eddi d\u00f9ng, v\u00ec c\u1eadp nh\u1eadt t\u1ef1 \u0111\u1ed9ng c\u00f3 th\u1ec3 di\u1ec5n ra m\u00e0 kh\u00f4ng \u0111\u01b0\u1ee3c ch\u00fa \u00fd.<\/p>\n

D\u1ea5u hi\u1ec7u n\u1ed5i b\u1eadt g\u1ed3m chu\u1ed7i svc-telemetry<\/code> trong t\u1ec7p SSH authorized keys, t\u1ec7p \u1ea9n ~\/.config\/.smt<\/code> v\u00e0 .smtk<\/code>, LaunchAgent com.apple.sysmond.plist<\/code>, t\u00e1c v\u1ee5 Windows SysMon<\/code>, c\u00f9ng k\u1ebft n\u1ed1i t\u1edbi \u0111\u1ecba ch\u1ec9 134.209.82[.]225 tr\u00ean c\u1ed5ng 22 ho\u1eb7c 8099. C\u00e1c t\u00ean n\u00e0y ph\u1ea3i \u0111\u01b0\u1ee3c \u0111\u00e1nh gi\u00e1 trong ng\u1eef c\u1ea3nh v\u00ec m\u1ed9t ch\u1ec9 b\u00e1o \u0111\u01a1n l\u1ebb ch\u01b0a lu\u00f4n \u0111\u1ee7 \u0111\u1ec3 k\u1ebft lu\u1eadn.<\/p>\n

Quy tr\u00ecnh \u1ee9ng ph\u00f3 an to\u00e0n<\/h2>\n

N\u1ebfu ph\u00e1t hi\u1ec7n ch\u1ec9 b\u00e1o, h\u00e3y c\u00f4 l\u1eadp m\u00e1y kh\u1ecfi m\u1ea1ng, l\u01b0u b\u1eb1ng ch\u1ee9ng v\u00e0 x\u00e1c \u0111\u1ecbnh xem m\u00e3 \u0111\u1ed9c ch\u1ec9 th\u1ef1c thi hay \u0111\u00e3 c\u00f3 phi\u00ean SSH \u0111\u0103ng nh\u1eadp. Sau \u0111\u00f3 m\u1edbi lo\u1ea1i b\u1ecf ti\u1ec7n \u00edch, kh\u00f3a SSH tr\u00e1i ph\u00e9p, ti\u1ebfn tr\u00ecnh \u0111\u01b0\u1eddng h\u1ea7m v\u00e0 c\u01a1 ch\u1ebf duy tr\u00ec. Ch\u1ec9 g\u1ee1 ti\u1ec7n \u00edch l\u00e0 ch\u01b0a \u0111\u1ee7 v\u00ec c\u00e1c t\u1ec7p \u0111\u1ed9c l\u1eadp v\u1eabn c\u00f3 th\u1ec3 ti\u1ebfp t\u1ee5c ch\u1ea1y.<\/p>\n

M\u1eadt kh\u1ea9u, token API, kh\u00f3a cloud, phi\u00ean \u0111\u0103ng nh\u1eadp v\u00e0 th\u00f4ng tin x\u00e1c th\u1ef1c kho m\u00e3 m\u00e0 t\u00e0i kho\u1ea3n b\u1ecb \u1ea3nh h\u01b0\u1edfng c\u00f3 th\u1ec3 ti\u1ebfp c\u1eadn c\u1ea7n \u0111\u01b0\u1ee3c thu h\u1ed3i ho\u1eb7c xoay v\u00f2ng t\u1eeb m\u1ed9t thi\u1ebft b\u1ecb s\u1ea1ch. Khi c\u00f3 b\u1eb1ng ch\u1ee9ng truy c\u1eadp t\u01b0\u01a1ng t\u00e1c, ph\u01b0\u01a1ng \u00e1n \u0111\u00e1ng tin c\u1eady h\u01a1n l\u00e0 d\u1ef1ng l\u1ea1i m\u00e1y t\u1eeb \u1ea3nh chu\u1ea9n v\u00e0 r\u00e0 so\u00e1t ho\u1ea1t \u0111\u1ed9ng ti\u1ebfp theo trong kho m\u00e3, CI\/CD v\u00e0 d\u1ecbch v\u1ee5 \u0111\u00e1m m\u00e2y.<\/p>\n

B\u00e0i h\u1ecdc cho qu\u1ea3n tr\u1ecb ti\u1ec7n \u00edch IDE<\/h2>\n

Doanh nghi\u1ec7p n\u00ean l\u1eadp danh m\u1ee5c ti\u1ec7n \u00edch \u0111\u01b0\u1ee3c ph\u00e9p, ghim phi\u00ean b\u1ea3n khi c\u1ea7n, l\u01b0u l\u1ecbch s\u1eed c\u00e0i \u0111\u1eb7t v\u00e0 gi\u00e1m s\u00e1t thay \u0111\u1ed5i \u1edf authorized_keys<\/code>, LaunchAgents, scheduled tasks c\u00f9ng l\u01b0u l\u01b0\u1ee3ng SSH b\u1ea5t th\u01b0\u1eddng. Marketplace l\u00e0 m\u1ed9t l\u1edbp ph\u00e2n ph\u1ed1i thu\u1eadn ti\u1ec7n, kh\u00f4ng ph\u1ea3i ranh gi\u1edbi tin c\u1eady tuy\u1ec7t \u0111\u1ed1i.<\/p>\n

\u0110\u1ed9i ph\u00e1t tri\u1ec3n c\u0169ng n\u00ean t\u00e1ch t\u00e0i kho\u1ea3n \u0111\u1eb7c quy\u1ec1n kh\u1ecfi ho\u1ea1t \u0111\u1ed9ng vi\u1ebft m\u00e3 h\u1eb1ng ng\u00e0y, h\u1ea1n ch\u1ebf b\u00ed m\u1eadt t\u1ed3n t\u1ea1i l\u00e2u trong bi\u1ebfn m\u00f4i tr\u01b0\u1eddng v\u00e0 s\u1eed d\u1ee5ng token ng\u1eafn h\u1ea1n. Nh\u1eefng bi\u1ec7n ph\u00e1p n\u00e0y l\u00e0m gi\u1ea3m thi\u1ec7t h\u1ea1i ngay c\u1ea3 khi m\u1ed9t ti\u1ec7n \u00edch h\u1ee3p l\u1ec7 b\u1ecb thay th\u1ebf trong th\u1eddi gian ng\u1eafn.<\/p>\n

K\u1ebft lu\u1eadn<\/h2>\n

S\u1ef1 c\u1ed1 Claude Code tr\u00ean Cursor l\u00e0 v\u00ed d\u1ee5 \u0111i\u1ec3n h\u00ecnh v\u1ec1 t\u1ea5n c\u00f4ng chu\u1ed7i cung \u1ee9ng nh\u1eafm v\u00e0o c\u00f4ng c\u1ee5 ph\u00e1t tri\u1ec3n. \u0110i\u1ec1u quan tr\u1ecdng kh\u00f4ng ch\u1ec9 l\u00e0 g\u1ee1 b\u1ea3n 2.1.312 v\u00e0 2.1.313, m\u00e0 c\u00f2n ph\u1ea3i s\u0103n t\u00ecm d\u1ea5u v\u1ebft, thu h\u1ed3i th\u00f4ng tin x\u00e1c th\u1ef1c v\u00e0 x\u00e1c minh to\u00e0n b\u1ed9 m\u00e1y tr\u1ea1m. Ph\u1ea3n \u1ee9ng d\u1ef1a tr\u00ean b\u1eb1ng ch\u1ee9ng s\u1ebd gi\u00fap tr\u00e1nh c\u1ea3 hai th\u00e1i c\u1ef1c: xem nh\u1eb9 v\u00ec m\u00e3 \u0111\u1ed9c c\u00f3 l\u1ed7i, ho\u1eb7c m\u1edf r\u1ed9ng k\u1ebft lu\u1eadn sang nh\u1eefng k\u00eanh ph\u00e2n ph\u1ed1i kh\u00f4ng b\u1ecb \u1ea3nh h\u01b0\u1edfng.<\/p>\n

VNCyberS<\/strong> t\u1ed5ng h\u1ee3p t\u1eeb Cursor, BleepingComputer, Phorion v\u00e0 OpenSourceMalware<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

M\u1ed9t phi\u00ean b\u1ea3n \u0111\u1ed9c h\u1ea1i c\u1ee7a ti\u1ec7n \u00edch Claude Code \u0111\u00e3 xu\u1ea5t hi\u1ec7n tr\u00ean Cursor VS Code Extension Marketplace trong kho\u1ea3ng 11 gi\u1edd ng\u00e0y 29\/10\/2026. S\u1ef1 c\u1ed1 cho th\u1ea5y m\u1ed9t g\u00f3i c\u00f3 giao di\u1ec7n v\u00e0 ch\u1ee9c n\u0103ng h\u1ee3p l\u1ec7 v\u1eabn c\u00f3 th\u1ec3 tr\u1edf th\u00e0nh \u0111\u01b0\u1eddng v\u00e0o m\u00e1y tr\u1ea1m ph\u00e1t tri\u1ec3n n\u1ebfu m\u00e3 \u0111\u1ed9c \u0111\u01b0\u1ee3c ch\u00e8n […]<\/p>\n","protected":false},"author":2,"featured_media":2170,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[5],"tags":[569,1047,354,347,86,1048,483,1049],"class_list":["post-2171","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-kien-thuc","tag-claude-code","tag-cursor","tag-developer-security","tag-incident-response","tag-malware","tag-ssh-backdoor","tag-supply-chain-attack","tag-vs-code-extension"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2171","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=2171"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2171\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/2170"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=2171"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=2171"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=2171"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}