🎯 SSH Authorized Keys

The items that name it 4

• Trojanized Claude Code Extension Plants an SSH Backdoor
  writeupas techniques2026-10-30It is written here as SSH Authorized Keys (T1098.004).

  Appends Ed25519 key labeled svc-telemetry to ~/.ssh/authorized_keys (mode 0600, ~/.ssh mode 0700)

• Cursor Removes Malicious Claude Code 2.1.313 Extension From Its Marketplace
  articleas techniques2026-10-30It is written here as SSH Authorized Keys (T1098.004).

  The reported macOS sample adds an SSH authorized key for attacker access. The page gives no ATT&CK id, so this id comes from outside the page.

• Backdoor in Claude Code for VS Code extension on the Cursor Marketplace
  writeupas techniques2026-10-30It is written here as SSH Authorized Keys (T1098.004).

  Payload appends an attacker Ed25519 public key (comment svc-telemetry) to ~/.ssh/authorized_keys using fs.appendFileSync, with 0700 on the directory and 0600 on the file.

• BufferZoneCorp Malicious Gems & Go Modules
  writeupas classification.key entities2026-05-06It is written here as T1098.004.