The Accidental C2 - Exploring Dev Tunnels for Remote Access

This research dissects the VS Code Dev Tunnels stack (REST management, WebSocket relay, SSH over WebSocket, MsgPack RPC), demonstrates a PoC tool named Ouroboros that can list tunnels and remotely execute commands/read/write files, and highlights abuse scenarios — including GitHub/Azure OAuth token misuse, device-code phishing, and token pivoting via FOCI/BroCI — that enable persistence, lateral movement, and initial access.