Lazarus Contagious Interview Cloud Pivot within 60min of Code.exe Execution

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects rapid post-exploitation activity where a developer's workstation, upon executing VS Code (Code.exe), initiates outbound network connections to major cloud service or CI/CD provider APIs (GitHub, AWS, Azure, GCP) within 60 minutes. This behavior is indicative of the Lazarus Group 'Contagious Interview' campaign, where stolen credentials from developer environments are used to pivot into cloud infrastructure or CI/CD pipelines.