OctoRAT

OctoRAT is a .NET-based remote access trojan (RAT) observed as the third-stage payload in a supply-chain attack delivered through the malicious Visual Studio Code extension "prettier-vscode-plus" on the official VSCode Marketplace. In the documented attack chain, a VBScript dropper launched a PowerShell payload containing an AES-encrypted blob, which decrypted and executed the Anivia loader in memory; Anivia then decrypted and injected OctoRAT into the legitimate vbc.exe process using process hollowing. Both Anivia and OctoRAT were reported to use AES-256-CBC with PKCS7 padding for payload protection.

The malware provides full remote access and was described as supporting more than 70 commands. Reported capabilities include surveillance, file theft, remote desktop control, persistence, privilege escalation, harassment functions, and operation of a SOCKS proxy on infected hosts. It targets browser credentials, autofill data, session cookies, and cryptocurrency wallets from Chrome, Firefox, and Edge. OctoRAT was also reported to disable Windows security features such as UAC and Firewall via registry and netsh commands.

For privilege escalation, OctoRAT uses the FodHelper UAC bypass technique and deletes registry traces afterward. Persistence was reported via a scheduled task named "WindowsUpdate" configured to run every minute. C2 communications include heartbeat mechanisms, robust error handling, and JSON-formatted reconnaissance packets. The default C2 configuration reportedly includes 127.0.0[.]1:8080, likely for development or testing. Internet-wide scanning identified at least seven active OctoRAT C2 panels, including 178.16.55[.]109 and 51.178.245[.]127. The panel is fingerprintable by the HTML title "OctoRAT Center - Login," and infrastructure analysis linked multiple panels to Railnet LLC hosting, with certificate reuse across servers in Germany and the Netherlands.

The malware was associated with a late-November 2025 campaign targeting developers through the VSCode extension ecosystem. The malicious extension impersonated the legitimate Prettier formatter, was published under the account "publishingsofficial," and remained available for roughly four hours before removal. Reported detection opportunities include monitoring for the "prettier-vscode-plus" extension, suspicious GitHub access used for payload hosting and rotation, vbc.exe process hollowing, and OctoRAT Center panel fingerprints. The campaign was analyzed by Checkmarx Zero and Hunt Intelligence, Inc.