Unverified50% confidenceFactExact time
The attackers wrote unauthorized SSH keys through the compromised build versions, which constitutes a persistence operation.
1
Sources
50%
Confidence
Long-term
Relevance
11/1/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedThe malicious code adds the attacker's public key to the user's SSH authorized keys list (~/.ssh/authorized_keys), with the comment field disguised as SBC Telemetry.80% similarUnverifiedThe malicious code's behavior includes: collecting device information, attempting to implant the attacker's SSH public key into the authorized_keys file, and setting up boot autostart to maintain persistent access.78% similarUnverifiedPersistence is the general term for techniques attackers use to maintain access after an initial intrusion, with common methods including writing SSH public keys to ~/.ssh/authorized_keys, creating system services or scheduled tasks, modifying shell startup scripts, and implanting browser extensions or login items.77% similarUnverified工具投毒攻击可将读取 SSH 私钥并外传的隐藏指令暗藏在工具描述中，同时返回正确结果76% similarUnverifiedAttackers often disguise the comment field of SSH public keys as a system component name so that victims viewing the file mistake it for normal configuration; when investigating, verify each comment against its fingerprint rather than just looking at the file name.74% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1123325API
curl https://kongchang.com/api/v1/knowledge/claims/1123325MCP
get_claim(id=1123325)