The executable, which comes in base64-encoded form, is decoded by the PowerShell script to connect with a secondary server at myaunet [.]su to download and run XMRig, a Monero cryptocurrency miner.

Microsoft has removed two popular VSCode extensions, 'Material Theme - Free' and 'Material Theme Icons - Free,' from the Visual Studio Marketplace for allegedly containing malicious code.