Microsoft VS Code Undermined in Asian Spy Attack

Palo Alto Networks' Unit 42 observed Mustang Panda abusing Visual Studio Code's Tunnel feature—effectively turning a signed VS Code binary into a reverse-shell—to perform reconnaissance, drop malware, and exfiltrate data from a Southeast Asian government target; investigators also found concurrent use of imecmnt.exe DLL sideloading to deploy the ShadowPad backdoor, suggesting overlapping or coordinated intrusions.