Inside a malicious Claude Code-branded extension and its persistent SSH backdoor

In this article 1. Attack chain overview 1. Attack chain 2. Host reconnaissance collection 3. SSH authorization and tunnel identities 4. Protocol Tunneling T1572: reverse SSH forwarding 5. Platform-specific startup persistence 2. Mitigation and protection guidance 1. Immediate actions 2...