The Microsoft signed and hosted Reverse Shell TL;DR; MS is offering a signed binary (code.exe), which will establish a Command&Control channel via an official

The Microsoft signed and hosted Reverse Shell TL;DR; MS is offering a signed binary (code.exe), which will establish a Command&Control channel via an official Microsoft domain https://vscode.dev https://vscode.dev. The C2 communication itself is going to https://global.rel.tunnels.api.visualstudio.com https://global.rel.tunnels.api.visualstudio.com over WebSockets. An attacker only needs an Github account.