Detects a process that is descended from Visual Studio Code (Code, Code.exe, Code Helper, etc.) or Cursor opening at least two distinct sensitive credential-related files within a single session. The rule targets potential credential harvesting by malicious IDE extensions or prompt-injected agents, using two data sources: endpoint.process events to identify the editor process and endpoint.file events to detect file-open actions. It normalizes filenames and anchors the editor ancestry, then links the editor lineage to the current file-open process via ancestry intersections. If a host/process opens two or more unique sensitive files (e.g., browser credential stores like logins.json, Login Data, Cookies; token and credential stores; SSH/npm/vault-related files) within the same editor session, the rule fires. The detection outputs context such as host, user, process, file names/paths, and the list of sensitive files opened. MITRE ATT&CK mappings include T1552 (Unsecured Credentials) and T1555 (Credentials from Password Stores) with T1555.003 (Credentials from Web Browsers), and T1176.002 (IDE Extensions) under Credential Access and Persistence. The rule targets Windows and macOS endpoints with a high severity and elevated risk score, and it is intended to prompt triage actions such as stopping the process, removing the extension, rotating affected credentials, and hunting for similar activity across hosts.