VS Code Phishing - Macro Tunnel Creation (T1059.005)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•1•0•4

Detects the malicious Word document macro executing the code.exe CLI to initiate the Microsoft device-code authentication flow.