Visual Studio Code provides a Remote Development feature.
PfiatDe did a test and verified this would serve as a valid and stealthy C2 channel.
The portable code CLI is signed by Microsoft, the attacker only needs a GitHub account, and the traffic runs over WebSockets to global.rel.tunnels.api.visualstudio.com.
The result is a remote PowerShell session in the browser, so living off the land now comes with syntax highlighting and tab completion.
The only interactive step is the GitHub device code login, because a VS Code developer confirmed that --access-token only accepts GitHub OAuth refresh tokens, so PfiatDe sent the device code to an interact.sh listener instead.
Defenders can block that tunnel domain and watch for code_tunnel.json in %UserProfile%\.vscode-cli.
