DPRK Actors Deploy VS Code Tunnels for Remote Hacking

A spear-phishing campaign attributed to North Korean actors is abusing a legitimate feature of Microsoft Visual Studio Code to gain full remote control of targeted systems, according to Darktrace. The South Korean targets receive government-themed emails with fake official documents, and the attached JSE files masquerade as Hangul Word Processor documents that quietly install VS Code and exploit a built-in tunneling capability.

This approach lets attackers bypass typical command-and-control infrastructure and operate with LotL-style techniques, blending in with normal developer activity. Once a malicious file is opened, a VS Code tunnel named "bizeugene" is established, enabling the attacker to connect to a remote machine through Microsoft’s tunnel service, with the compromised system linking via VS Code after the user signs in with GitHub or Microsoft.

The campaign reportedly marks a first for DPRK-linked actors using this exact tactic, though VS Code abuse in similar campaigns has been seen before. Elizabeth Montalbano reported this on 22 January 2026.