Claude Code Hooks as Initial Access & Persistence
DISCLAIMER: This article is intended strictly for educational and research purposes. The techniques, tools, and concepts discussed here are designed to enhance understanding of adversary tactics, improve defensive capabilities, and support authorized Red Team assessments. Any unauthorized or malicious use of the information provided is strongly condemned and may be illegal. Intro Do you remember the VSCode task backdoor ? The core idea was simple: you can’t blindly trust projects you open in your editor. An attacker could embed a surprise in .vscode/tasks.json, and the moment you trusted the workspace, a loader would silently fire in the background and your machine will be compromised. This technique was weaponized by DPRK affilated Lazarus group in their campaigns against IT companies. ...