Visual Studio Code Abused in Sophisticated Multistage Malware Attacks

**Executive summary:** The Evelyn Stealer campaign weaponizes seemingly legitimate Visual Studio Code extensions (e.g., themes and AI assistants) to run PowerShell/batch stagers that sideload a trojanized Lightshot DLL, deploy a process-hollowing second stage (iknowyou.model) which decrypts and runs the Evelyn Stealer payload, performs extensive anti-analysis checks, harvests browser credentials, cookies, clipboard, wallet data and system artifacts, packages them into contextual ZIPs, and exfiltrates data over FTP — posing a high risk to developer systems, source code, secrets, and enterprise CI/CD pipelines.