Trojanized Claude Code Extension SSH Backdoor Hunt

Goksel Atakan@gokselatakan

•updated yesterday•23•2•23

Detects SSH backdoor artifacts of a trojanized Claude Code editor extension: connections to the tunnel host, reverse SSH forwards to local port 22 and dropped persistence files. Needs Defender for Endpoint network, process and file events and covers only published indicators. The query ran without errors in a live tenant.