SecuriTricks - visual studio code

Don't Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal Cryptocurrency

Between April and May 2026, a likely North Korean threat actor conducted phishing campaigns targeting developers across nearly 100 organizations in finance, cryptocurrency, education, and technology sectors. The attacks used recruitment and code review themes, delivering emails with links to actor-…

north korea

credential theft

Published: June 8, 2026

Downloadable IOCs: 18

Contagious Interview: Evolution of VS Code and Cursor Tasks Infection Chains - Part 1

This intelligence report details the evolution of malware delivery techniques targeting integrated development environments (IDEs) like Visual Studio Code and Cursor. The threat actors, known as Contagious Interview, have expanded their payload staging methods to include GitHub Gists, URL shortener…

Published: February 27, 2026

Downloadable IOCs: 6

Developer-targeting campaign using malicious Next.js repositories

A coordinated campaign is targeting developers through malicious repositories disguised as legitimate Next.js projects and technical assessment materials. The attack uses multiple entry points that lead to runtime retrieval and local execution of attacker-controlled JavaScript, transitioning into s…

javascript

node.js

remote code execution

environment variable exfiltration

Published: February 24, 2026

Downloadable IOCs: 4

Threat Actors Expand Abuse of Microsoft Visual Studio Code

North Korean threat actors have evolved their techniques in the Contagious Interview campaign, now abusing Microsoft Visual Studio Code task configuration files. The infection chain begins when a victim opens a malicious Git repository, often disguised as part of a recruitment process. If trust is …

Published: January 21, 2026

Downloadable IOCs: 8

From Extension to Infection: An In-Depth Analysis of the Evelyn Stealer Campaign Targeting Software Developers

The Evelyn Stealer campaign targets software developers through weaponized Visual Studio Code extensions, employing a multistage delivery of information-stealing malware. The attack chain involves a downloader disguised as a legitimate Lightshot DLL, an injector that uses process hollowing to injec…

anti-analysis techniques

Published: January 20, 2026

Downloadable IOCs: 5

Operation AkaiRyū: Europe invited to Expo 2025 and ANEL backdoor revived

Chinese threat actor MirrorFace expanded its cyberespionage activities beyond Japan, targeting a Central European diplomatic institute in relation to Expo 2025. The group refreshed its tactics, introducing new tools like customized AsyncRAT and reviving the ANEL backdoor previously associated with …

Published: March 18, 2025

Downloadable IOCs: 6

Tag: visual studio code

Attack reports

Don't Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal Cryptocurrency

Contagious Interview: Evolution of VS Code and Cursor Tasks Infection Chains - Part 1

Developer-targeting campaign using malicious Next.js repositories

Threat Actors Expand Abuse of Microsoft Visual Studio Code

From Extension to Infection: An In-Depth Analysis of the Evelyn Stealer Campaign Targeting Software Developers

Operation AkaiRyū: Europe invited to Expo 2025 and ANEL backdoor revived