Researchers uncover SleepyDuck RAT hidden in VSX extension, using Ethereum contracts to control infected hosts.