Threat actors expand abuse of Microsoft Visual Studio Code