🎯 SSH authorized_keys persistence

The items that name it 3

• Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines
  writeup2026-10-30

  The loader planted an attacker SSH key (svc-telemetry) in ~/.ssh/authorized_keys

• AI-Powered Espionage Campaign Targets Government Linux Infrastructure
  article2026-10-15

  Injected a public key for passwordless access

• Numbat
  repo2026-09-05