VS Code Phishing - Capturing Device Code Output

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•8

This rule correlates the execution of the VS Code CLI ('code.exe') with the output redirection of a command prompt ('cmd.exe') to a temporary text file. This behavior is indicative of an attempt to scrape authentication codes, potentially for phishing or credential theft, specifically targeting the 'tunnel' functionality of VS Code.