VS Code extensions abused to deploy stealthy infostealer

EXECUTIVE SUMMARY:

This advisory describes a malicious campaign abusing Visual Studio Code extensions to deploy a stealthy infostealer on developer workstations. The attack begins when developers install what appear to be benign marketplace extensions: a cryptocurrency-themed color scheme and an AI coding assistant. Both extensions are published under the same entity and contain hidden code that executes system commands whenever the editor is used. Once installed, the extensions download and run a modified screenshot utility bundled with a malicious dynamic library. This payload silently captures desktop images, harvests stored wireless credentials, reads clipboard data, inventories software and processes, and launches headless browser instances to hijack session cookies. Collected information is staged locally before being transmitted to remote infrastructure controlled by the attacker. Because the extensions deliver functional features alongside the malicious logic, the compromise can remain undetected while attackers gain ongoing visibility into source code, corporate communications, and authentication material. Organizations relying on Visual Studio Code for software development, especially in environments with access to production systems, cloud management consoles, or financial assets, face an elevated risk of source code theft, credential compromise, and downstream breaches stemming from a single compromised developer endpoint.[emaillocker id="1283"]

The malicious ecosystem centers on two Visual Studio Code extensions that embed hidden execution paths alongside legitimate functionality. The first, presented as a visual theme, abuses an unrestricted activation trigger so its code runs on virtually any editor event. It invokes a script engine to download and unpack additional components, initially using password-protected archives and multiple decompression fallbacks to maximize reliability. Later iterations replace this complex chain with a streamlined batch script that fetches an executable and companion library directly, hides the command window, and uses a marker file to avoid repeated execution. The second extension operates as a fully functional coding assistant, integrating chat capabilities within the editor while discreetly calling the same payload delivery routine. Both ultimately deploy a legitimate screenshot utility paired with a malicious dynamic library that leverages side-loading to gain execution under a trusted binary. Once active, the infostealer creates a dedicated working directory, enumerates system details, process lists, and installed applications, captures the clipboard and desktop image, extracts stored wireless credentials, and starts headless browser instances with minimal windows to access session data.

Observed activity demonstrates a focused effort to weaponize the software extension ecosystem as a delivery channel for stealthy information theft. By combining convincing social engineering themes with real utility, the attacker achieves both reach and persistence inside developer environments that often bridge corporate, cloud, and personal resources. The use of a legitimate screenshot utility with a side-loaded library, coupled with continuous refinement of the loader scripts, reflects an iterative development cycle aimed at improving reliability and reducing visible artifacts. System reconnaissance, credential harvesting, browser session hijacking, and continuous screen capture collectively provide a rich picture of victim activity and access paths into downstream systems. Rather than deploying disruptive payloads, the campaign prioritizes silent collection and exfiltration, positioning the operators to monetize stolen credentials, source code, and sensitive business information at a later stage. Within the broader threat landscape, this activity illustrates how extension marketplaces and developer tooling have become attractive vectors for targeting technology-centric organizations and high-value individuals.

THREAT PROFILE:

MBC MAPPING:

REFERENCES:

The following reports contain further technical details:

• https://www.koi.ai/blog/the-vs-code-malware-that-captures-your-screen
• https://thehackernews.com/2025/12/researchers-find-malicious-vs-code-go.html