Editor Process Reads MachineGuid Then Rapid Outbound Connection (Open VSX Fingerprinting Payload)

Duo Tech@duotech

•updated Aug 5, 2026•1•0•1

Detects a code editor process (VS Code, Cursor, Windsurf, VSCodium) reading the MachineGuid registry value followed within 3-8 seconds by an outbound network connection to a non-private IP from the same process on the same host, consistent with Open VSX evil-twin extensions harvesting developer machine identifiers and exfiltrating fingerprinting data.