VSCode Remote Tunneling Abuse by Kimsuky

Brandon Rodriguez@BMRodriguez

•updated May 21, 2026•9•0•221

Detects the execution of the VSCode CLI (code.exe) with the 'tunnel' argument, particularly when executed from uncommon directories like ProgramData or Users\Public, or when automated via piped input. This technique is actively abused by Kimsuky to establish covert C2 channels that bypass traditional network detections.