Tag
GitHub Internal Repositories Breached via Malicious VS Code Extension
2 rules 7 TTPsA GitHub employee's device was compromised via a malicious VS Code extension, leading to the theft of approximately 3,800 internal repositories by threat actor TeamPCP (UNC6780), who then offered the data for sale.
CVE-2026-41613 - Visual Studio Code Session Fixation Vulnerability
2 rules 1 TTP 1 CVECVE-2026-41613 is a session fixation vulnerability in Visual Studio Code that allows an unauthorized attacker to elevate privileges over a network.
VScode Remote Tunnel Abuse for Command and Control
2 rules 1 TTPAdversaries are leveraging the VScode remote tunnel feature to establish unauthorized access and control over Windows systems, potentially enabling command and control activities via disguised legitimate software.
Detection of Suspicious VScode Remote Tunnel Usage
2 rules 1 TTPThis brief details the detection of potential command and control activity through the suspicious use of the VScode remote tunnel feature, which allows attackers to establish unauthorized remote access to systems.
Suspicious Execution from VS Code Extension
2 rules 9 TTPsMalicious VS Code extensions can execute arbitrary commands, leading to initial access and subsequent payload deployment on Windows systems.