Unverified50% confidenceDecision RuleExact time
Attackers often disguise the comment field of SSH public keys as a system component name so that victims viewing the file mistake it for normal configuration; when investigating, verify each comment against its fingerprint rather than just looking at the file name.
1
Sources
50%
Confidence
Long-term
Relevance
10/31/2026
First Seen
Sources
Related Entities
Related Claims
Unverified工具投毒攻击可将读取 SSH 私钥并外传的隐藏指令暗藏在工具描述中，同时返回正确结果77% similarUnverifiedThe malicious code adds the attacker's public key to the user's SSH authorized keys list (~/.ssh/authorized_keys), with the comment field disguised as SBC Telemetry.76% similarUnverifiedssh-agent exposes a Unix domain socket, whose path is typically stored in the environment variable SSH_AUTH_SOCK, through which other programs send signing requests71% similarUnverifiedIf the firmware is tampered with, an attacker can replace the recipient address or amount before signing, and the secure element will still sign the wrong data.70% similarUnverifiedThe malicious code's behavior includes: collecting device information, attempting to implant the attacker's SSH public key into the authorized_keys file, and setting up boot autostart to maintain persistent access.70% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1118957API
curl https://kongchang.com/api/v1/knowledge/claims/1118957MCP
get_claim(id=1118957)