TigerJack Malicious VSCode and OpenVSX Extensions Steal Code and Mine Cryptocurrency

Security researchers have uncovered a coordinated campaign by the threat actor group TigerJack, which targets developers by publishing malicious extensions on both Microsoft's Visual Studio Code (VSCode) Marketplace and the OpenVSX registry. The campaign involves at least 11 different extensions distributed across multiple publisher accounts, with some extensions accumulating over 17,000 downloads before being removed from the official VSCode Marketplace. Despite removal from Microsoft's platform, these extensions remain active and available on the OpenVSX marketplace, which is used by alternative VSCode-compatible editors such as Cursor and Windsurf. The malicious extensions serve various purposes, including exfiltrating developers' source code, mining cryptocurrency using the host's resources, and maintaining persistent remote access. For example, the 'C++ Playground' extension registers a listener to capture and exfiltrate C++ source code in near real-time, while the 'HTTP Format' extension secretly runs a CoinIMP cryptominer in the background, consuming the host's processing power without restrictions. Some variants of the extensions are capable of fetching and executing remote JavaScript code, allowing TigerJack to dynamically update their payloads and potentially deploy additional threats such as credential stealers, ransomware, or API-harvesting scripts. The campaign demonstrates a high level of persistence, with TigerJack repeatedly re-uploading the same malicious code under new names and accounts after takedowns. The extensions are designed to appear as legitimate developer tools, increasing the likelihood of installation by unsuspecting users. The use of OpenVSX as a distribution channel poses a significant risk, as it is less regulated than Microsoft's marketplace and serves as the default for several popular IDEs. Researchers from Koi Security have been actively tracking the campaign and have highlighted the ongoing threat posed by these extensions, especially given their ability to maintain remote control and adapt their functionality without requiring updates. The campaign underscores the risks associated with third-party extension marketplaces and the importance of vetting and monitoring developer tools for malicious behavior. The technical sophistication of the extensions, particularly their ability to execute remote code and evade detection, raises concerns about long-term supply chain compromise within the developer ecosystem. Organizations and individual developers are advised to review installed extensions, monitor for suspicious activity, and prioritize security hygiene when sourcing tools from community-driven marketplaces. The continued presence of these extensions on OpenVSX, despite removal from the official VSCode Marketplace, highlights the challenges in fully eradicating such threats from the software supply chain. Security experts warn that the campaign is ongoing, with TigerJack actively seeking new ways to distribute their malicious payloads and compromise developer environments.