Silent Intrusion: VS Code Exploit For Unauthorized Access

Cyble Research and Intelligence Labs uncovered a sophisticated campaign where a malicious .LNK installer silently deploys an embedded Python runtime and an obfuscated update.py that installs/uses the VSCode CLI to create remote tunnels authenticated via GitHub device activation codes. The malware achieves persistence by creating a scheduled task (MicrosoftHealthcareMonitorNode) that can run with SYSTEM privileges, collects system and user data, exfiltrates information (including the activation code) to a C2 at requestrepo.com, and enables remote file access and command execution; the report includes SHA-256 hashes and URLs as indicators of compromise.