Unverified50% confidenceFactExact time
The malicious code adds the attacker's public key to the user's SSH authorized keys list (~/.ssh/authorized_keys), with the comment field disguised as SBC Telemetry.
1
Sources
50%
Confidence
Long-term
Relevance
10/31/2026
First Seen
Sources
Related Claims
UnverifiedThe malicious code's behavior includes: collecting device information, attempting to implant the attacker's SSH public key into the authorized_keys file, and setting up boot autostart to maintain persistent access.79% similarUnverifiedAttackers often disguise the comment field of SSH public keys as a system component name so that victims viewing the file mistake it for normal configuration; when investigating, verify each comment against its fingerprint rather than just looking at the file name.76% similarUnverified工具投毒攻击可将读取 SSH 私钥并外传的隐藏指令暗藏在工具描述中，同时返回正确结果75% similarUnverifiedThe core security risk of SSH agent forwarding is that once a remote host is compromised, an attacker can use the forwarded agent socket to impersonate the user and access other systems without ever touching the private key itself72% similarUnverifiedThe algorithm confusion attack between RS256 and HS256 can allow an attacker to use the public key as an HMAC secret to forge tokens that the server will accept as valid.72% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1118946API
curl https://kongchang.com/api/v1/knowledge/claims/1118946MCP
get_claim(id=1118946)