Hackers Exploit Visual Studio Code to Deploy Malicious Payloads on Victim Systems

The report describes the 'Contagious Interview' campaign in which attackers host malicious Git repositories that, when trusted in Visual Studio Code, leverage tasks.json to run nohup/curl piped into Node.js and deploy obfuscated JavaScript backdoors (hosted on vercel.app). The payloads provide remote code execution, system fingerprinting, and persistent C2 beacons; Jamf Threat Labs observed active exploitation, URL changes after takedowns, and the introduction of heavy obfuscation to evade detection.