----------------🎯 AI: Malicious Claude Code-branded extension with a persistent SSH backdoor, inside Microsoft's trackin...

----------------🎯 AI: Malicious Claude Code-branded extension with a persistent SSH backdoor, inside Microsoft's tracking of North Korean AI adoption===================Executive summaryMicrosoft Threat Intelligence published a short report on October 29 (14 minute read) tracking how North Korean threat actors operationalize AI to increase the speed and efficiency of attacks, with what the team describes as varying levels of adoption across actors. The showcased sample is a malicious extension branded as Claude Code that establishes a persistent SSH backdoor on the machine where it runs.The extension and the backdoorThe core artifact borrows the Claude Code name. Claude Code is a legitimate AI coding assistant, which makes the branding an effective trust anchor: a developer looking for AI tooling sees a familiar name and installs. Once in place, the implant's job, per the report title, is persistence: an SSH backdoor that keeps providing remote access. A backdoor of this class on a deve...