VS Code and Cursor: Credential harvesting by IDE extensions

Extensions and sub-processes associated with Visual Studio Code and Cursor IDEs are being observed accessing multiple distinct sensitive files in a single session. This behavior is symptomatic of credential harvesting, potentially performed by malicious IDE extensions or agents manipulated through prompt injection. The access targets browser credential stores, cloud access tokens, and SSH or package manager configuration files.

Attack Chain

1. An attacker publishes a malicious IDE extension or compromises an existing one.
2. The target developer installs or updates the malicious extension.
3. The extension is executed within the context of the IDE process tree (e.g., extensionHost).
4. The malicious extension or a sub-process spawned by the IDE attempts to open sensitive files.
5. The attacker iterates through multiple credential stores (e.g., cookies, SSH keys, .npmrc).
6. The retrieved data is exfiltrated or utilized to escalate privileges in cloud environments.

Impact

Successful exploitation results in the unauthorized exfiltration of locally stored developer secrets, including browser-based credentials, cloud infrastructure tokens, and SSH keys. This enables lateral movement, persistent access to code repositories, and potential compromise of connected cloud infrastructure.

Recommendation

• Audit installed extensions in VS Code and Cursor for unauthorized or suspicious publishers.
• Implement monitoring for processes spawned by IDE processes that attempt to access multiple sensitive credential stores.
• For incident responders: If suspicious access is detected, isolate the host, rotate all credentials identified in accessed files, and audit recent IDE extension installations.
• Establish a policy requiring developers to review extension permissions before installation.