Lazarus Contagious Interview - Malicious VS Code Task Auto-Executing Code on Folder Open

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects Visual Studio Code spawning common command-line shells or interpreters (cmd.exe, powershell.exe, python, etc.) with suspicious command-line arguments, such as network download utilities (curl, wget, Invoke-WebRequest) or potentially malicious obfuscated/long arguments, which may indicate developer environment exploitation or software supply chain attacks.