Chinese hackers use Visual Studio Code tunnels for remote access

Operation Digital Eye (June–July 2024) is a targeted espionage campaign observed by SentinelLabs and Tinexta Cyber in which attackers exploited internet-facing services with sqlmap, deployed a PHP webshell (PHPsert), moved laterally using RDP and pass-the-hash with a custom Mimikatz, and established persistent, stealthy backdoors by running a portable Visual Studio Code (code.exe) as a service and abusing VSCode tunnels routed through Microsoft Azure (*.devtunnels.ms), enabling authenticated remote access that evades many security controls.