Unverified50% confidenceFactExact time
Identifier hijacking in SSH configuration (such as inserting malicious Host sections, ProxyCommand or LocalCommand) is a common credential theft technique.
1
Sources
50%
Confidence
Long-term
Relevance
10/31/2026
First Seen
Sources
Fake Claude Plugin Slips into Cursor Store: 11-Hour Window Requires Urgent Self-Check
bilibiliLinXunFeng10/31/2026
Related Entities
Related Claims
Unverifiedssh-agent exposes a Unix domain socket, whose path is typically stored in the environment variable SSH_AUTH_SOCK, through which other programs send signing requests75% similarUnverifiedSSH (Secure Shell) is an encrypted network protocol that allows users to securely remotely control another computer over an unsecured network.73% similarUnverifiedThe core security risk of SSH agent forwarding is that once a remote host is compromised, an attacker can use the forwarded agent socket to impersonate the user and access other systems without ever touching the private key itself71% similarUnverified工具投毒攻击可将读取 SSH 私钥并外传的隐藏指令暗藏在工具描述中，同时返回正确结果70% similarUnverifiedAttackers often disguise the comment field of SSH public keys as a system component name so that victims viewing the file mistake it for normal configuration; when investigating, verify each comment against its fingerprint rather than just looking at the file name.69% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1119827API
curl https://kongchang.com/api/v1/knowledge/claims/1119827MCP
get_claim(id=1119827)