Unverified50% confidenceFactExact time
Persistence is the general term for techniques attackers use to maintain access after an initial intrusion, with common methods including writing SSH public keys to ~/.ssh/authorized_keys, creating system services or scheduled tasks, modifying shell startup scripts, and implanting browser extensions or login items.
1
Sources
50%
Confidence
Long-term
Relevance
11/1/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedThe attackers wrote unauthorized SSH keys through the compromised build versions, which constitutes a persistence operation.77% similarUnverifiedThe malicious code's behavior includes: collecting device information, attempting to implant the attacker's SSH public key into the authorized_keys file, and setting up boot autostart to maintain persistent access.74% similarUnverifiedAfter running, the extension performed operations such as collecting detailed system information, reading the user's git email address, enumerating environment variable names, attempting to add an SSH key controlled by the attacker, opening a reverse tunnel, and setting up auxiliary persistence mechanisms.70% similarUnverifiedSSH outbound tunnels can bypass firewalls and NAT blocking of inbound traffic, and attackers achieve persistent login by writing to ~/.ssh/authorized_keys.70% similarUnverifiedThe core security risk of SSH agent forwarding is that once a remote host is compromised, an attacker can use the forwarded agent socket to impersonate the user and access other systems without ever touching the private key itself69% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1123331API
curl https://kongchang.com/api/v1/knowledge/claims/1123331MCP
get_claim(id=1123331)