VS Code Phishing - Remote Relay Establishment (T1090)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•1•0•3

Correlates the code.exe service initiating encrypted, SSH-like tunnel relay connections without legitimate user IDE engagement.