A backdoor in the Claude Code extension for VS Code has been discovered, allowing attackers to establish persistent SSH access on macOS, Linux, and Windows. The extension's persistence mechanism relies on a user-launch agent, making it difficult to detect. Remediation involves uninstalling the extension, killing active tunnel processes, removing persistence, and rotating credentials. Phorion's detection coverage flags the macOS persistence and provides visibility into the attack chain. AI summary
Firehose
Filtered to Hacker News, tagged “backdoor” · clear filters
Browse: People · Companies · Papers · Podcasts · Hacker News · Deep dives