Lazarus Contagious Interview: git clone to VS Code shell spawn hitting suspicious staging infra

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•4

This rule detects a multi-stage activity chain where a user performs a git clone, followed by Visual Studio Code, Node, or Python spawning a shell or interpreter, which then initiates a network connection to known suspicious staging infrastructure. This behavior is indicative of a developer machine being compromised to exfiltrate code or download malicious payloads.