Stealer reads AI coding assistant / MCP config files (Claude, Cursor, Windsurf, Factory, Zed, VS Code, opencode)
Detects instances where the Node.js runtime environment (node.exe) accesses sensitive configuration, settings, or message control protocol (mcp) files within directories associated with common developer IDEs and text editors like Claude, Cursor, Windsurf, Zed, and VS Code. This activity may indicate an attempt to exfiltrate IDE configuration, API keys, or environment settings.
Microsoft Sentinel (KQL)
