Contagious Interview Cloud Credential Theft via node.exe or python.exe from Code.exe
Detects potential credential theft (e.g., InvisibleFerret/BeaverTail malware) where a node.js or python process, spawned as a child process of VS Code (Code.exe), attempts to read sensitive cloud credential files for AWS, Azure, or GCP.
YARA-L
