Trojanized Claude Code extension persistence: sysmond LaunchAgent, cron, SysMon

ills3c Intel&Coffee@Ills3C

•updated today•0•0•0

Detects persistence mechanisms associated with the trojanized anthropic.claude-code loader, including macOS LaunchAgent creation (com.apple.sysmond), Linux cron @reboot persistence using hidden config files (.smt), Windows scheduled tasks (SysMon SYSTEM task), and SSH authorized keys manipulation.