Cyble Research and Intelligence Lab (CRIL) researchers have uncovered a sophisticated campaign that starts with a suspicious .LNK file and uses Visual Studio Code (VSCode) to establish persistence and remote access – and installs the VSCode command line interface (CLI) if VSCode isn’t found on the victim machine. The script checks if VSCode is already installed on the system by looking for the directory at “%LOCALAPPDATA%\microsoft\VScode.” If the directory isn’t found, the script downloads the VSCode Command Line Interface (CLI) from a Microsoft source: “hxxps://az764295.vo.msecnd.net/stable/97dec172d3256f8ca4bfb2143f3f76b503ca0534/vscode_cli_win32_x64_cli[.]zip.” Once downloaded, the file is extracted, and the executable file “code.exe” is placed into the “%LOCALAPPDATA%\microsoft\VScode” directory.
This Cyber News was published on thecyberexpress.com. Publication date: Wed, 02 Oct 2024 05:43:05 +0000