Dark Side of VSCode
How Attacker Abuse VSCode as RAT?
Last updated
How Attacker Abuse VSCode as RAT?
Last updated
How an attacker can exploit a very peaceful and legitimate program that you use daily to attack your device in a way that I find very unique. First, let's understand that VSCode uses Remote Development, which means it connects to Microsoft servers via SSH to link it to the WORKSPACE Server. This is very beneficial as it keeps the developer in a safe zone from downloading malicious packages and ensures that everything is under Microsoft's watchful eye. The image below illustrates this concept.
Authentication is performed through GitHub, Microsoft ID, or Entra ID, which establishes a connection with Microsoft's tunnel server (dev tunnels). This creates an endpoint corresponding to Phase 1. Attackers may then start hunting for these dev tunnel hosts.
Dev Tunnels Use the Following Hosts
Authentication:
github.com
login.microsoftonline.com
Dev Tunnels:
global.rel.tunnels.api.visualstudio.com
[clusterId].rel.tunnels.api.visualstudio.com
[clusterId]-data.rel.tunnels.api.visualstudio.com
*.[clusterId].devtunnels.ms
*.devtunnels.ms
The list of clusterId values is available at: Dev Tunnels Cluster List.
Detection Strategy
To detect dev tunnels, it would be beneficial to monitor the aforementioned communications within networks where VSCode is not typically used, such as in business departments or production segments.
The attacker does something quite clever by executing under the process of VSCode or PowerShell “node.exe” execute under VSCode and Image Path is “%USERPROFILE%¥.vscode¥cli¥servers¥Stable- [ID]¥server¥node.exe“. PowerShell (pwsh.exe) is run under node.exe. If the actor creates a new terminal, it's an anomaly, and you can detect the VSCode tunnel by that path and process name. So, simply put, VSCode can be used as a RAT (Remote Access Trojan) or APT (Advanced Persistent Threat).
By using dev tunnels, the attacker can control remotely via proxies owned by Microsoft itself and can persist the tunnel on the machine using the "code tunnel service" command to make an autorun registry entry:
