Developer tooling abuse: what it means for IAM and NHI governance

TL;DR: Malicious Visual Studio Code extensions, DLL hijacking, and in-memory payloads are being used to steal credentials, cookies, VPN profiles, and wallet data from developer machines, according to Anomali citing Trend Micro research. The pattern shows why developer endpoints need privileged handling, because a single compromise can expose access paths into source repositories, cloud consoles, and production environments.

NHIMG editorial — based on content published by Anomali: Anomali Cyber Watch on Evelyn Stealer, PDFSider malware, and related threats

Questions worth separating out

Q: How should security teams protect developer machines that handle credentials and tokens?

A: Treat developer machines as privileged endpoints.

Q: Why do developer environments increase the risk of credential theft?

A: Developer environments often sit close to source repositories, cloud consoles, and administrative tooling, so one compromise can expose both human and non-human identities.

Q: What breaks when organisations rely on trusted software to prevent malware execution?

A: Trust alone breaks when attackers hide inside legitimate tools such as extensions, sideloaded libraries, or signed applications.

Practitioner guidance

• Treat developer endpoints as privileged assets Apply stricter device hardening, application control, and monitoring to engineering workstations that can reach source code, cloud consoles, or secret stores.
• Constrain extension and plugin trust Allow only approved Visual Studio Code extensions and review any workspace features that can trigger script execution, process loading, or network access.
• Rotate exposed credentials and sessions immediately If a developer endpoint is suspected, invalidate browser sessions, rotate tokens, and review VPN and cloud access tied to the affected user or service.

What's in the full analysis

Anomali's full article covers the operational detail this post intentionally leaves for the source:

• The specific tradecraft used by the malware, including how the fake developer tooling is delivered and executed.
• The source article's referenced detection and attribution context, which practitioners can use to compare with their own telemetry.
• The full analyst commentary on why developer environments are increasingly attractive for credential theft.
• The linked research context from Trend Micro, which gives the original campaign analysis and technical evidence.

👉 Read Anomali's analysis of malware that abuses developer tooling to harvest credentials →

Developer tooling abuse: what it means for IAM and NHI governance?

Explore further

View Full Forum →  |  NHI Foundation Course →