Keylogger, perhaps.  The multiplexing just makes it trivial to connect to everything with no logging and no authentication.  I don&#x27;t even have to modify the PATH or install a keylogger.  I am already several steps beyond that in one move.  In other words, no audit trail for the FBI to look into, no need to upload some new application, no need to exploit a vulnerable application (beyond the vulnerability of OpenSSH itself by design).<p>Perhaps some of the confusion here is that it is assumed ssh keys are in use?  In an environment that requires 2FA, keys would not be allowed.  People would be using RSA Tokens, Duo, Yubikeys, etc.  This method bypassing those things.<p>It also means, anyone using the defaults in OpenSSH is not PCI compliant.<p>I am not even sure this method of access to development or production environments is even illegal, as the user is providing access and I am not hacking anything, nor am I using authentication into anything.  The door is wide open.  If this were a game of chess, I would get check-mate in 1 move.