Extension Process Reads .git/config or .git/HEAD Then Exfiltrates Data Over Network
Detects a process accessing .git/config or .git/HEAD files followed by a network connection or HTTP request from the same agent within a short time window, consistent with the Open VSX 'evil twin' extension campaign harvesting private repository and CI metadata and exfiltrating it to attacker-controlled infrastructure.
Cortex XDR
