Editor Settings/Telemetry Opt-Out Read Followed by Network Transmission

Duo Tech@duotech

•updated Aug 5, 2026•1•0•4

Detects a settings.json (editor settings/telemetry opt-out) file read followed within a 30-second window by network transmission from the same host, a pattern consistent with the Open VSX 'evil twin' extension campaign in which extensions read local developer configuration/telemetry preference files and then exfiltrate the harvested data over the network.