Loading story…
A supply chain attack was discovered involving 19 malicious Visual Studio Code extensions that leveraged typosquatting and steganography techniques to distribute a Rust-based trojan. These extensions, masquerading as legitimate tools, were designed to compromise developer environments by deploying malware built with the Rust programming language, highlighting the growing threat of malicious code infiltrating popular development platforms through third-party add-ons.
The use of Rust for malware development is part of a broader trend, as threat actors increasingly adopt modern languages like Rust to create cross-platform threats that are harder to analyze and detect. The specific trojan deployed via the VS Code extensions is related to the emerging "Luca Stealer," a Rust-based information stealer capable of targeting both Linux and Windows systems. This shift to Rust-based malware presents new challenges for defenders, requiring updated analysis techniques and tools to effectively identify and mitigate these sophisticated threats.
Trace attribution and downstream blast radius.
2 events from the most recent confirmed update back to the earliest known activity.
A supply-chain campaign targeting Visual Studio Code was discovered involving 19 malicious extensions. The attackers used typosquatting and steganography to deliver a Rust-based trojan through the extension ecosystem.
Researchers analyzed Luca Stealer, an open-source information stealer written in Rust that targets Linux and Windows systems. The analysis highlighted reverse-engineering challenges and indicators such as Rust build artifacts, specific strings, and a related sample hash.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers at ReversingLabs have identified a sophisticated campaign in which 19 malicious Visual Studio Code (VS Code) extensions were uploaded to the VS Code Marketplace, targeting developers by hiding a Trojan within their dependency folders. The attackers modified a widely trusted npm package, `path-is-absolute`, to include malicious code that executed upon VS Code startup, ultimately decoding a JavaScript dropper concealed in a file named `lock`. The final payload was disguised as a `banner.png` file, which, despite its image extension, was actually an archive containing two malicious binaries. This campaign, active since February 2025 and discovered in December, highlights the risks of supply chain attacks in developer ecosystems. The malicious extensions either impersonated popular packages or claimed to offer new functionalities, but in reality, they executed harmful code on developers' machines. The use of legitimate dependencies as a vector for malware delivery demonstrates an evolution in threat actor tactics, making detection more difficult. Researchers also noted a broader trend of increasing malware submissions to the VS Code Marketplace, including incidents where legitimate extensions were compromised through malicious pull requests that added harmful dependencies. This incident underscores the need for heightened scrutiny of third-party code and dependencies in development environments.
Jun 29, 2026
Security researchers have uncovered a coordinated campaign by the threat actor group TigerJack, which targets developers by publishing malicious extensions on both Microsoft's Visual Studio Code (VSCode) Marketplace and the OpenVSX registry. The campaign involves at least 11 different extensions distributed across multiple publisher accounts, with some extensions accumulating over 17,000 downloads before being removed from the official VSCode Marketplace. Despite removal from Microsoft's platform, these extensions remain active and available on the OpenVSX marketplace, which is used by alternative VSCode-compatible editors such as Cursor and Windsurf. The malicious extensions serve various purposes, including exfiltrating developers' source code, mining cryptocurrency using the host's resources, and maintaining persistent remote access. For example, the 'C++ Playground' extension registers a listener to capture and exfiltrate C++ source code in near real-time, while the 'HTTP Format' extension secretly runs a CoinIMP cryptominer in the background, consuming the host's processing power without restrictions. Some variants of the extensions are capable of fetching and executing remote JavaScript code, allowing TigerJack to dynamically update their payloads and potentially deploy additional threats such as credential stealers, ransomware, or API-harvesting scripts. The campaign demonstrates a high level of persistence, with TigerJack repeatedly re-uploading the same malicious code under new names and accounts after takedowns. The extensions are designed to appear as legitimate developer tools, increasing the likelihood of installation by unsuspecting users. The use of OpenVSX as a distribution channel poses a significant risk, as it is less regulated than Microsoft's marketplace and serves as the default for several popular IDEs. Researchers from Koi Security have been actively tracking the campaign and have highlighted the ongoing threat posed by these extensions, especially given their ability to maintain remote control and adapt their functionality without requiring updates. The campaign underscores the risks associated with third-party extension marketplaces and the importance of vetting and monitoring developer tools for malicious behavior. The technical sophistication of the extensions, particularly their ability to execute remote code and evade detection, raises concerns about long-term supply chain compromise within the developer ecosystem. Organizations and individual developers are advised to review installed extensions, monitor for suspicious activity, and prioritize security hygiene when sourcing tools from community-driven marketplaces. The continued presence of these extensions on OpenVSX, despite removal from the official VSCode Marketplace, highlights the challenges in fully eradicating such threats from the software supply chain. Security experts warn that the campaign is ongoing, with TigerJack actively seeking new ways to distribute their malicious payloads and compromise developer environments.
Jun 29, 2026
Malicious Visual Studio Code extensions have been used to infect software developers with the **Evelyn Stealer**, a multistage malware payload designed to abuse trust in developer tooling and compromise developer workstations. Reporting indicates the campaign used a first-stage downloader disguised as a **Lightshot DLL**, followed by a second-stage injector that decrypted and hollow-injected the final payload into `grpconv.exe`, while related analysis also linked the malware to **screen-capture activity** inside infected environments. The final stealer employed anti-analysis and anti-virtual-machine checks, stole browser credentials through DLL injection, gathered system information and cryptocurrency wallet data, captured screenshots, and exfiltrated stolen data to attacker-controlled infrastructure over **FTP**. Researchers said the operation showed notable maturity through techniques including **AES-256-CBC** encryption, process hollowing, and targeted collection from developer systems, underscoring the risk posed by trojanized extensions in widely used coding platforms.
Aug 21, 2026