Tracking the VS Code Tasks Infection Vector

The Contagious Interview campaign, attributed to North Korea, continues to target software developers through fake recruitment schemes. A new technique in their arsenal leverages Microsoft Visual Studio Code task files to execute malicious code when a project is opened. The report documents observations of this vector, presents GitHub-based discovery methods, highlights findings including a new malicious NPM package, and outlines detection opportunities. The campaign exploits VS Code's Task feature, using the runOptions property to automatically execute malicious shell commands when a workspace is opened. Various obfuscation techniques are employed, including hiding commands with whitespace and masquerading payloads as image or font files.

• Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code RepositoriesMalware2026-04-21
• WeaselBiscuit Strips BeaverTail and OtterCookie Down to EssentialsMalware2026-09-18
• The npm Threat Landscape: Attack Surface and MitigationsMalware2026-04-25
• Case of AgentTesla Malware Distribution Disguised as a Business Proposal EmailMalware2026-10-14
• Warden Stealer: The Rapid Rise of an Infostealer with an Appetite for AI Agent DataMalware2026-10-09