security: Inside a malicious Claude Code-branded extension and its persistent SSH backdoor

Microsoft describes a malicious extension branded as Claude Code that installs a persistent SSH backdoor, and provides detection and remediation guidance. The post focuses on how the extension behaves and how to identify affected systems.

• Source: Microsoft Security Blog