Lazarus Contagious Interview: InvisibleFerret Python Backdoor via VS Code

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects instances where the Python interpreter (python.exe or python3.exe) is spawned as a child process of common development environments like Visual Studio Code (code.exe) or Node.js runtime processes. This behavior may indicate an adversary using development tools as a proxy for executing malicious scripts or unauthorized code during post-exploitation activities.