In the background, the batch script executes an obfuscated Python loader named WhirlCoil that's also present in the archive. The Python loader subsequently establishes a Visual Studio Code remote tunnel to establish persistent backdoor access and harvests system information and the contents of various user directories. The data and the remote tunnel verification code are sent to a free request logging service (e.g., requestrepo[. Proofpoint told The Hacker News that it has observed TA415 incorporate incremental changes in the infection chain used to deliver Visual Studio Code Remote Tunnels since it was first used a year ago. "Additionally, TA415 activity leveraging Visual Studio Code Remote Tunnels has remained highly targeted and low in volume, particularly before the recent uptick observed in July and August detailed in our reporting."