VSCode Infostealer: Python browser harvester spawned from node/npm with C2 POST
Detects Python processes spawned from development tools (Node.js, VS Code, Cursor) that perform suspicious file access to browser credential stores (e.g., Login Data, cookies.sqlite) and subsequently initiate significant outbound network POST requests, characteristic of browser-based credential harvesting and exfiltration.
Microsoft Sentinel (KQL)
