Contagious Interview: Evolution of VS Code and Cursor Tasks Infection Chains · Part 1

This intelligence report details the evolution of malware delivery techniques targeting integrated development environments (IDEs) like Visual Studio Code and Cursor. The threat actors, known as Contagious Interview, have expanded their payload staging methods to include GitHub Gists, URL shorteners, Google Drive, and custom domains. New infection chains involve complex loaders, including a custom stack-based bytecode VM and PyArmor-protected Python malware. The report highlights the actors' adaptability in response to takedowns and community reporting, showcasing their use of various obfuscation techniques and masquerading tactics. Detection opportunities and indicators of compromise are provided, including suspicious process behaviors, file paths, and network requests.

• SEO Poisoning Campaign Delivers New Armorsteal MalwareMalware2026-10-22
• Case of AgentTesla Malware Distribution Disguised as a Business Proposal EmailMalware2026-10-14
• Warden Stealer: The Rapid Rise of an Infostealer with an Appetite for AI Agent DataMalware2026-10-09
• From Registry-Stored PowerShell to In-Memory Cryptocurrency Mining: A Multi-Stage Infection ChainCampaign2026-09-21
• WeaselBiscuit Strips BeaverTail and OtterCookie Down to EssentialsMalware2026-09-18