Unverified50% confidenceFactExact time
The malicious code's behavior includes: collecting device information, attempting to implant the attacker's SSH public key into the authorized_keys file, and setting up boot autostart to maintain persistent access.
1
Sources
50%
Confidence
Long-term
Relevance
10/30/2026
First Seen
Sources
Nearly 5,000 Affected! AI Coding Plugin Found with Backdoor, Officials Urgently Remove It
bilibiliToken家有吞金兽10/30/2026
Related Entities
Related Claims
Unverified防御SSH暴力破解的有效手段包括禁用密码登录仅允许公钥认证、更改默认端口、部署fail2ban，以及通过VPN消除公网暴露76% similarUnverified封装安装包常见的恶意植入手段包括键盘记录器、后台挖矿程序和凭证窃取模块（扫描浏览器Cookie、本地密码管理文件和SSH密钥）76% similarUnverified工具投毒攻击可将读取 SSH 私钥并外传的隐藏指令暗藏在工具描述中，同时返回正确结果75% similarUnverifiedAn attacker can induce a user to open a malicious HTML file larger than 256KB and use the preview panel to read SSH private keys and cloud service credentials (such as AWS and GCP access keys).74% similarUnverifiedAttackers may be able to exploit this PHP vulnerability to execute code remotely without authentication.74% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1118329API
curl https://kongchang.com/api/v1/knowledge/claims/1118329MCP
get_claim(id=1118329)