VS Code Binary Staged in Non-Standard Path

Jorden Smith@Jorden

•updated Jan 8, 2026•0•19

Detects code.exe file creation in non-standard locations such as user home directories or temp folders, indicating potential staging of VS Code CLI for malicious purposes