Evelyn Stealer Delivered via Malicious Visual Studio Code Extensions

Trend Micro reported a multi-stage information-stealing campaign, dubbed Evelyn Stealer, that targets software developers by weaponizing the Visual Studio Code extension ecosystem. The operation relies on trojanized extensions as an initial access vector into developer environments, then uses staged loaders and stealth techniques (including process hollowing, DLL injection, and anti-analysis measures) to execute the infostealer and evade detection; Trend Micro noted the use of strong cryptography such as AES-256-CBC as part of the malware’s operational security.

Once established, Evelyn Stealer focuses on harvesting high-value data commonly present on developer workstations, including browser credentials and cookies, cryptocurrency wallet data, screenshots, clipboard contents, Wi‑Fi details, and other sensitive artifacts that can enable broader compromise. Reporting also describes a specific execution chain in which a malicious extension drops a fake Lightshot.dll that is loaded by LightShot.exe, triggering a hidden PowerShell command to fetch and run a second-stage payload; stolen data and system details are then exfiltrated to attacker infrastructure (including an attacker-controlled FTP server). Researchers warned that compromising even a single developer endpoint could expose credentials and access paths that enable follow-on intrusion into production systems, cloud environments, and wider enterprise networks.