Trojanized anthropic.claude-code 2.1.313 extension: on-disk artifact, reverse SSH tunnel and C2

Falcon Eye@FalconEye

•updated today•7•0•15

Detects the presence of the compromised anthropic.claude-code VS Code extension version 2.1.313 or its associated bad hash on disk, reverse SSH tunneling spawned by code editors or extension hosts, and network connections to known malicious C2 IP address 134.209.82.225.