CampaignPublished 21 Jan 2026Updated 20 Feb 2026

Threat Actors Expand Abuse of Microsoft Visual Studio Code

Source AlienVault OTX General

Description

North Korean threat actors have evolved their techniques in the Contagious Interview campaign, now abusing Microsoft Visual Studio Code task configuration files. The infection chain begins when a victim opens a malicious Git repository, often disguised as part of a recruitment process. If trust is granted, arbitrary commands are executed on the system. The malware uses JavaScript payloads hosted on vercel.app to implement backdoor logic, including remote code execution, system fingerprinting, and persistent command-and-control communication. The backdoor collects host information and beacons to a C2 server every five seconds. Recent observations show further execution of similar payloads, indicating ongoing development of these tactics.

Impact

For European organizations, especially those involved in software development, recruitment, and technology sectors, this threat poses significant risks. The abuse of VS Code task files can lead to unauthorized remote code execution, allowing attackers to gain persistent access to sensitive systems. This compromises confidentiality by enabling data theft, including intellectual property and personal information. Integrity is at risk as attackers can modify or inject malicious code into development environments. Availability could be affected if attackers deploy destructive payloads or disrupt operations. The use of legitimate developer tools and platforms like GitHub and GitLab increases the likelihood of successful social engineering attacks, particularly in organizations with remote or hybrid workforces. The persistent C2 communication every five seconds facilitates ongoing espionage and lateral movement within networks. European organizations with macOS endpoints and those relying heavily on VS Code are particularly vulnerable. The campaign's disguise as recruitment processes may also target HR departments, increasing the attack surface.

Defensive guidance

1. Enforce strict policies on trusting VS Code workspace and task configuration files, especially from unknown or unverified Git repositories. 2. Educate employees, particularly in HR and development teams, about the risks of interacting with unsolicited recruitment-related repositories. 3. Implement endpoint detection and response (EDR) solutions capable of monitoring and alerting on suspicious VS Code task executions and Node.js script activities. 4. Monitor network traffic for frequent beaconing patterns, especially connections to suspicious domains like vercel.app or IPs such as 87.236.177.9, and block or investigate anomalous C2 communications. 5. Use application allowlisting to restrict execution of unauthorized scripts and binaries. 6. Regularly audit and restrict permissions on developer tools and repositories to minimize exposure. 7. Integrate threat intelligence feeds to detect known indicators of compromise (IOCs) such as the provided hashes and domains. 8. Encourage multi-factor authentication and least privilege principles for access to development and recruitment platforms. 9. Maintain up-to-date backups and incident response plans tailored to supply chain and developer toolchain attacks.

Indicators of compromise

Domains 1

srv37746.hosted-by-eurohoster.org

IP addresses 1

87.236.177.9

Hashes 7

1b26f73fa88f8c3b17adf6db12ec674481db1f92eb04806815b8fbd6086f07ef
67c05c1624a227959728e960e4563435db2519a24a46e95207a42ea8d4307e2d
71d8a974548e4e152e2c818d1febb7862632c1f9bff6adaa731bbaf6b23bd4b9
71e4ea17c871b983a2cbbea7a4fbd7fe498951c8fe4a1e17377e9aa06fd7184a
932a67816b10a34d05a2621836cdf7fbf0628bbfdf66ae605c5f23455de1e0bc
a2194390105731ce33cb9a51011c42a39a440942e907099f072916a36f17ef4b
f8ae6ae9d6a13a8dddb05975930161601b5cfdd0cec30b7efdc5ba0606774998

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 21 Jan 2026, 23:35 UTC

MITRE ATT&CK techniques11 from threat tags

Technical details

Indicators of compromise

Domains 1

IP addresses 1

Hashes 7

Community reviews

Related threats