VS Code for Malware Delivery

Researchers have uncovered a new evolution of the “Contagious Interview” campaign, where North Korean-linked attackers weaponize Visual Studio Code (VS Code) to deliver malicious payloads directly onto developer systems. This marks a shift from phishing emails to exploiting trusted development environments.

Attack Chain

1. Malicious repositories: Attackers host poisoned GitHub/GitLab repos disguised as job interview assignments.
2. VS Code trust prompt: When victims open the repo and grant trust, VS Code automatically processes tasks.json.
3. Embedded commands: tasks.json contains malicious instructions that execute arbitrary code silently.
4. Payload retrieval: On macOS, background shell commands (nohup bash + curl) fetch JavaScript payloads from attacker infrastructure (e.g., Vercel-hosted servers).
5. Execution in Node.js: Payload runs independently of VS Code, persisting even after the editor closes.
6. C2 connection: Malware beacons every 5 seconds to 87.236.177.93, sending system info (hostname, MAC, OS).
7. Long-term access: Attackers can push additional JavaScript instructions, enabling remote command execution and persistence.

Why It’s Dangerous

• Trusted workflow abuse: Exploits VS Code’s repository trust model.
• Obfuscated JavaScript: Payloads hidden in dictionary files, making detection harder.
• Persistence outside VS Code: Attack continues even if the editor is closed.
• Stealthy beaconing: Regular, low-noise communication with C2 server.
• Target audience: Developers—high-value victims with access to sensitive codebases.

Evolution of Tactics

• Previous methods: ClickFix-based phishing and malicious email links.
• Current method: Embedding payloads in VS Code configuration files (tasks.json).
• Obfuscation: Increasingly sophisticated JavaScript techniques to evade analysis.

Defensive Recommendations

• Scrutinize repositories: Review contents before granting trust in VS Code.
• Inspect tasks.json: Look for suspicious or obfuscated commands.
• Monitor network traffic: Beaconing to suspicious IPs (e.g., 87.236.177.93).
• Endpoint protection: Detect abnormal Node.js execution outside expected workflows.
• Developer awareness: Train teams to recognize malicious recruitment lures and poisoned repos.

Takeaway

This campaign highlights how legitimate developer tools can be weaponized. By embedding malicious payloads in VS Code projects, attackers bypass traditional phishing defenses and compromise developer environments at scale. Vigilance in repository trust decisions and configuration file inspection is critical to preventing compromise.