Python-Based Malware Slithers Into Systems via Legit VS Code

Researchers from Cyble CRIL uncovered an ongoing Mustang Panda APT campaign that begins with a malicious .lnk file delivering a Python distribution which installs a script that checks for VS Code, deploys the VS Code CLI if needed, and abuses VS Code Remote Tunnels plus GitHub authentication to create a persistent remote tunnel for unauthorized access, data collection, and further malware deployment; the script was initially undetected on VirusTotal and defenders are advised to use behavioral endpoint protections, review scheduled tasks, restrict install permissions, and train users against suspicious files.