Researchers reported a critical issue in Microsoft’s DebugMCP (v1.1.4) where a developer could be tricked into visiting a malicious webpage and end up with attacker code running on their machine. The attack abuses a locally running, unauthenticated server on port 3001 plus DNS rebinding to send a single background request that triggers the debugger to fetch and execute a remote Python payload.
This attack breakdown centers on DebugMCP, a debugging extension/server tied to VS Code workflows. After installation, the server automatically started and began listening on port 3001 without authentication. That alone would normally be contained by browser same-origin protections, but researchers used DNS rebinding, a technique that exploits how browsers cache DNS records, to get a malicious webpage's JavaScript to send a request that the browser treated as same-origin and delivered to the local service.
Once that request reached DebugMCP, it could pass an attacker-controlled UNC path into VS Code's debugging infrastructure. That infrastructure handed the path to the Python launcher, which reached out to an attacker-controlled SMB share and loaded a file. The file then executed under the victim's user context, all triggered by a single HTTP request and a webpage visit.
Several conditions combined to make this a working drive-by attack:
Defenders and developers should watch for signs that a local developer tool is being abused:
Developer workstations deserve treatment as high-value targets, since a compromised machine can expose live credentials, source code, and trusted access to internal infrastructure. Organizations can reduce exposure by regularly auditing which servers are listening on loopback interfaces and by minimizing the number of local services exposed by developer tooling. Because malicious webpages can use techniques like DNS rebinding to reach local services, developers should treat unexpected links in chat, email, or tickets with caution, even when the destination looks like an ordinary webpage. Finally, keeping developer tooling updated matters even when fixes are shipped quietly, since unpatched extensions can retain powerful execution features that attackers can exploit through everyday browsing activity.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It was a critical issue in DebugMCP version 1.1.4 where visiting a malicious webpage could let an attacker achieve arbitrary code execution on a developer's machine without any further user interaction.
The attacker used DNS rebinding, a technique that exploits how browsers cache DNS records, to make a webpage's request reach the victim's local DebugMCP service listening on port 3001.
A compromised developer machine holds live credentials, source code, and trusted access to internal infrastructure, making it a high-value target for a single browsing event to lead to full compromise.
Yes, the fix was included in version 1.2.0 and later, though it was shipped silently without a version bump or advisory.
You click a link to “review this page,” and a few seconds later, Calculator pops up on your laptop… you never ran it. That’s a drive‑by RCE using the VS Code DebugMCP extension. Once installed, it quietly starts a server on localhost port 3001 with no authentication. A malicious site uses DNS rebinding so the browser thinks http://evil.attacker.com:3001 is safe, but the request actually hits your local DebugMCP server. Because DebugMCP 1.1.4 runs in stateless MCP mode, that single background request can call start_debugging with an attacker UNC path. VS Code’s debugger then pulls a Python script from an attacker SMB share and runs it under your user account, no extra clicks, just loading the page. If you use VS Code, here’s the move: right now, open your extensions, search for DebugMCP, and either update it fully or disable it, especially if you see it listening on port 3001.
Microsoft observed real-world campaigns where victims were tricked by “ClickFix” prompts into pasting a command into Windows Run, which then installed ACR (Amatera) Stealer. The malware steals saved browser passwords, live session tokens, and Microsoft 365/OneDrive/SharePoint files, meaning…
Attackers compromised Brevo’s Cloudflare setup using a long-lived API key found in source code, then altered website content at the CDN edge. Visitors were shown fake Cloudflare verification prompts to run Windows commands, and logged-in WordPress admins were targeted with a hidden backdoor plugin…
Researchers say a real macOS malware campaign is using “ClickFix” social engineering to trick users into installing an infostealer called AmnesiaStealer. Victims are lured to a counterfeit GitHub download page that encourages them to copy/paste a Terminal command, which then downloads and runs the…
A real ClickFix campaign used 250+ lookalike domains and browser fingerprinting to show malware lures mainly to real macOS visitors while showing harmless decoys to scanners and researchers. Victims were pushed to copy and run an obfuscated command in macOS Terminal, which then downloaded and…
Researchers reported a real phishing campaign (“Operation BlueDash”) that tricks users with a “secure document” lure and routes them to a fake Microsoft Store page that claims Microsoft Teams must be updated. The download installs legitimate remote access tools (Level RMM and ScreenConnect) so…
Cisco Talos investigated a real infection chain seen at a Ukrainian government organization where a disguised DLL was executed directly from a WebDAV network path. Attackers used a compromised website to show a fake Google CAPTCHA-style “verification” prompt that tricks users into running a copied…
