Weaponized VS Code Extensions Deliver Evelyn Stealer to Developers

Malicious Visual Studio Code extensions have been used to infect software developers with the Evelyn Stealer, a multistage malware payload designed to abuse trust in developer tooling and compromise developer workstations. Reporting indicates the campaign used a first-stage downloader disguised as a Lightshot DLL, followed by a second-stage injector that decrypted and hollow-injected the final payload into grpconv.exe, while related analysis also linked the malware to screen-capture activity inside infected environments.

The final stealer employed anti-analysis and anti-virtual-machine checks, stole browser credentials through DLL injection, gathered system information and cryptocurrency wallet data, captured screenshots, and exfiltrated stolen data to attacker-controlled infrastructure over FTP. Researchers said the operation showed notable maturity through techniques including AES-256-CBC encryption, process hollowing, and targeted collection from developer systems, underscoring the risk posed by trojanized extensions in widely used coding platforms.