VS Code Phishing - Tasklist Monitoring Loop (T1057)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•5

Maps the macro executing tasklist repeatedly to monitor whether code.exe has stopped running, indicating the victim completed authentication.