Lazarus Contagious Interview VS Code folderOpen Task Auto-Execution

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•3

Detects Visual Studio Code or Cursor IDE spawning interpreter processes like node.exe or python.exe. This behavior is indicative of a malicious .vscode/tasks.json configuration leveraging the 'runOn': 'folderOpen' feature to achieve automatic execution of code upon opening a workspace, a technique associated with the Lazarus Group 'Contagious Interview' campaign.