Malicious Visual Studio Code Extensions Distribute Infostealer Malware

Security researchers have identified two malicious extensions on the Microsoft Visual Studio Code Marketplace, named Bitcoin Black and Codo AI, which were designed to infect developer machines with information-stealing malware. These extensions, published under the developer name 'BigBlack', masqueraded as a premium dark theme and an AI-powered coding assistant, but secretly downloaded additional payloads, took screenshots, and exfiltrated sensitive data such as code, emails, Slack messages, WiFi passwords, clipboard contents, and browser sessions to attacker-controlled servers. Microsoft has since removed these extensions from the marketplace after their discovery, but not before they were downloaded and installed by several users. The malware leveraged PowerShell and batch scripts to download and execute payloads, with later versions hiding execution windows to evade user detection.

Technical analysis revealed that both extensions delivered a legitimate Lightshot screenshot tool alongside a malicious DLL, which was loaded via DLL hijacking to deploy the infostealer under the name runtime.exe. The malicious DLL was detected by multiple antivirus engines and created persistence by establishing directories in the %APPDATA%\Local\ path. The Codo AI extension embedded its malicious code within a functioning tool, making it harder to detect, while Bitcoin Black activated on every VS Code action. The campaign highlights the risks of third-party extensions in developer environments and the need for vigilance when installing tools from public marketplaces.