Inside a malicious Claude Code-branded extension and its persistent SSH backdoor
In this article Attack chain overview Attack chain Host reconnaissance collection SSH authorization and tunnel identities Protocol Tunneling (T1572): reverse SSH forwarding Platform-specific startup persistence Mitigation and protection guidance Immediate actions Remediation actions Follow-up Investigation and recovery Microsoft Defender XDR detections Threat intelligence reports Microsoft Defender XDR Threat analytics Advanced hunting queries MITRE ATT&CK techniques Indicators of compromise …
Cursor US