Malicious AI-Generated VS Code Extension with Ransomware Capabilities

A malicious Visual Studio Code extension named susvsex was discovered on the official VS Code Marketplace, openly advertising its ransomware-like capabilities. The extension, attributed to the publisher 'suspublisher18', was designed to automatically zip, exfiltrate, and encrypt files from a designated directory upon installation or launch of VS Code. Researchers noted that the extension's code appeared to be generated with the help of artificial intelligence, featuring hardcoded variables for command-and-control (C2) operations and an embedded GitHub access token. The extension polled a private GitHub repository for commands and wrote execution results back to the same repository, with the associated GitHub account traced to Azerbaijan. Microsoft removed the extension after it was reported, but initial inaction raised concerns about the vetting process for marketplace submissions.

The extension's current configuration targeted a test directory, minimizing immediate impact, but researchers warned that the target could be easily changed in future updates or via C2 commands. The extension's explicit description and lack of obfuscation suggested it may have been an experiment to test marketplace security controls. The incident highlights the growing risk of AI-assisted malware development and the need for improved monitoring and response mechanisms in software extension ecosystems, especially as attackers leverage public marketplaces to distribute malicious code with destructive capabilities.