Kimsuky, the North Korean state actor most defenders track as Velvet Chollima, is now using Microsoft’s Visual Studio Code Remote Tunnel service as a command-and-control channel against South Korean military and corporate targets. The HTTPSpy campaign documented this week ran through March and April 2026 and pairs spoofed security software installation pages with a fake Webex meeting page. The C2 traffic exits victim networks looking like legitimate developer activity, because that’s exactly what it is.

That same week, Microsoft published its own disclosure on the Mini Shai-Hulud typosquatting campaign against npm. Malicious packages are quietly siphoning cloud and CI/CD credentials out of developer workstations and build runners. Two separate incidents, two different threat clusters, one uncomfortable truth for cybersecurity teams: the tooling your developers depend on has become the attacker’s preferred logistics network.

What HTTPSpy actually does on the wire

Kimsuky’s chain starts with the social engineering you’d expect from a mature APT. Spoofed installers that look like legitimate antivirus updates. A convincing fake Webex landing page that captures credentials and seeds the dropper. What’s new is the post-foothold logistics. HelloDoor backdoors get planted, HTTPSpy harvests host data, and the operator console rides on top of code.visualstudio.com tunnels.

The tunnel endpoint is signed by Microsoft. The TLS certificate is signed by Microsoft. Most egress filters will pass that traffic without a second glance, because it looks exactly like the developer down the hall connecting to her work laptop from home. That’s the entire purpose of the feature, and a perfectly reasonable design choice. The bug is in defender assumptions.

For a threat detection team that built its alert tree around “block outbound to suspicious hosts,” there’s nothing suspicious about this. The host is global, signed, and required by half your engineering org. The Kimsuky operators figured that out and are walking through it.

The npm side of the same problem

The Mini Shai-Hulud activity Microsoft documented is a typosquat campaign with patient operators. Developers install a package whose name is one letter off from a real one, post-install scripts execute, and credentials get exfiltrated. The targeted material is what you’d predict: AWS keys, GCP service accounts, GitHub PATs, npm tokens, anything that gives the attacker a path into CI/CD or cloud infrastructure.

The defensive ceiling on this is uncomfortable. Once a malicious package lands on a build runner with permission to call cloud APIs, the entire downstream surface is in scope. Endpoint detection that watches a developer’s user behavior doesn’t necessarily see what a build agent does in the middle of a pipeline run. And the brute-force defenses you’ve layered on the perimeter are doing nothing here, because nobody is brute-forcing anything. The credentials walked out the front door inside a JSON manifest.

Why your existing cybersecurity controls miss both

The connective tissue is trust. VS Code Tunnels are trusted because Microsoft signs them. npm is trusted because your build pipeline literally cannot function without it. Container registries get the same trust pass, which is why the Kaspersky writeup on container security this week is worth reading alongside the other two reports. Supply-chain compromises, misconfigurations, and vulnerable base images don’t trip the alerts you’ve tuned on east-west traffic and identity anomalies.

Defense in depth has historically meant stacking controls at network and identity boundaries. The flaw these campaigns expose is that developer infrastructure crosses every one of those boundaries by design. Your build agent has cloud credentials. Your developer’s laptop has SSH keys, source repositories, and now a Microsoft-signed tunnel out of the network. A firewall rule built around “block outbound to suspicious hosts” gives you nothing when the suspicious host is global.code-tunnels.azurewebsites.net.

The Charter Communications breach announced this week, with 4.9 million records exfiltrated by ShinyHunters, gets the headlines. The slower story is the one Microsoft, Kaspersky, and The Hacker News all happened to publish in the same news cycle. Attackers have stopped fighting your perimeter because your perimeter doesn’t run through your developers anymore. It runs around them.

What to actually do this quarter

The fix is reclassifying developer infrastructure as critical and applying the security hardening you already use elsewhere. None of these steps require a new vendor. All of them assume you’re willing to treat the developer side of the house with the same paranoia you apply to Active Directory. A focused starter list:

• Inventory every developer workstation and build runner. If you can’t name the device and its owner, you can’t defend it.
• Audit VS Code Remote Tunnel usage at the network egress layer. Most organizations have no idea who’s running tunnels or where they terminate. Allowlist by user and team, and alert on first-seen activations.
• Pin npm, PyPI, and Composer dependencies by hash, not version. Enable provenance verification where the registry supports it. Block post-install script execution in CI by default, with explicit per-package exceptions.
• Treat CI/CD secrets as short-lived. Federate to cloud providers via OIDC instead of static keys wherever possible. Rotate what you can’t federate on a schedule tighter than your typical breach detection window.
• Add egress baselining specifically for build runners. A runner that suddenly talks to a Discord webhook, a Telegram bot, or an unfamiliar S3 bucket should page someone before the job completes.
• Update your incident response playbook to include “developer workstation popped” and “build agent compromised” as distinct scenarios, each with a 30-minute containment SLA and a credential-rotation checklist.

Kimsuky’s tunnel pivot and the Mini Shai-Hulud npm campaign are not the same operation. They are the same observation. The most expensive line item in your defensive program right now is the gap between how seriously you treat your domain controllers and how casually you treat the laptops where your engineers actually build software. Pick whichever one of these stories motivates your team to audit the build pipeline this month, and start there. Modern cyber security programs that haven’t put developer egress, package provenance, and CI/CD secret handling under the same incident response umbrella as endpoint protection are defending a wall the attackers stopped attacking years ago.

Sources

• Kimsuky Deploys HTTPSpy, Expands Arsenal with HelloDoor and VS Code Tunnels
• Typosquatted npm packages used to steal cloud and CI/CD secrets
• What’s in the container? Analyzing vulnerabilities, risks and protection with Kaspersky Container Security
• Charter Communications data breach affects 4.9 million accounts