Threat Actors Weaponizing Visual Studio Code to Deploy a Multistage Malware

Trend Micro and telemetry described a multistage campaign (Evelyn Stealer) that abuses a trojanized Visual Studio Code extension to drop a fake Lightshot DLL, launch staged payloads via hidden PowerShell, inject browsers, harvest credentials, wallets, VPN/Wi‑Fi profiles and sensitive files, compress results, and exfiltrate data to an attacker-controlled FTP server—posing high risk to developers who hold source code and cloud credentials.