🎯 Protocol Tunneling

The items that name it 3

• Inside a malicious Claude Code-branded extension and its persistent SSH backdoor
  writeup2026-10-31It is written here as Protocol Tunneling (T1572).

  Loader opens an outbound reverse SSH tunnel with -N -R '*:0:localhost:22' so the attacker can reach the workstation's SSH port.

• Socket: 737 Malicious VPN/Proxy Chrome Extensions Impersonate 66 Brands
  writeup2026-08-12

  Paid tier uses VLESS-REALITY tunneling on port 443, distinct from the free extension's SOCKS5 relay, designed to survive deep packet inspection

• Socket: Popular Go Decimal Library Targeted by Long-Running Typosquat with DNS Backdoor
  writeup2026-05-20

  Listed by the page as a technique associated with the DNS TXT-based C2 channel