Microsoft found attackers weaponizing Next.js “technical assessments” that trigger C2 the moment you open the project in VS Code. Three execution paths, same backdoor.