Inside a malicious Claude Code-branded extension and its persistent SSH backdoor

October 30 16 min read From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths Teams support impersonation led to remote access, malicious runtime execution, and Certificate Services abuse through authentication relay and Kerberos.