Tag: vs code

6 Attack Reports | 0 Vulnerabilities

Attack reports

Tracking the VS Code Tasks Infection Vector

The Contagious Interview campaign, attributed to North Korea, continues to target software developers through fake recruitment schemes. A new technique in their arsenal leverages Microsoft Visual Studio Code task files to execute malicious code when a project is opened. The report documents observa…
obfuscation
north korea
npm
github
beavertail
contagious interview
vs code
invisibleferret
software developers
2026-01-23
recruitment schemes
task files
Published: January 23, 2026
Downloadable IOCs: 13

VS Code extensions contain trojan-laden fake image

A malicious campaign involving 19 Visual Studio Code extensions has been uncovered, hiding malware in dependency folders. Active since February 2025, the campaign abuses a legitimate npm package to avoid detection and crafts an archive containing malicious binaries disguised as a PNG image. The att…
npm
vs code
rust trojan
2025-12-11
Published: December 11, 2025
Downloadable IOCs: 0

Loophole allows threat actors to claim VS Code extension names

A loophole in VS Code Marketplace allows malicious actors to reuse names of removed extensions. ReversingLabs discovered this vulnerability after finding a malicious extension with the same name as one previously identified. The platform's documentation states that extension names must be unique, b…
vulnerability
open-source
cybersecurity
extension
vs code
software supply chain
2025-08-29
loophole
package names
Published: August 29, 2025
Downloadable IOCs: 0

Malicious pull request infects VS Code extension

A VS Code extension for Ethereum smart contract development, ETHcode, was compromised through a GitHub pull request. The attacker, using a newly created account, submitted a PR that introduced a malicious dependency and code to execute it. The compromise was subtle, involving only two lines of code…
github
vs code
supply chain attack
ethereum
javascript obfuscation
2025-07-09
ethcode
keythereum-utils
pull request
Published: July 9, 2025
Downloadable IOCs: 0

VS Code Extension Impersonating Zoom Targets Google Chrome Cookies

A malicious Visual Studio Code extension masquerading as a Zoom application was discovered, designed to access and steal Google Chrome cookies. The extension, uploaded to the VS Code Marketplace on November 30 and updated on December 8, impersonates the Zoom Workspace tool to gain users' trust. It …
vs code
zoom
2025-01-21
cookies
Published: January 21, 2025
Downloadable IOCs: 3

Unraveling the Sophisticated Attack Leveraging VS Code for Unauthorized Access

A sophisticated attack has been uncovered that exploits Visual Studio Code's remote tunnel capabilities for unauthorized access. The attack begins with a .LNK file, disguised as a legitimate setup, which downloads a Python package and executes a malicious script. This script establishes persistence…
apt
python
cyber espionage
lnk file
github
2024-10-01
remote tunnel
unauthorized access
vs code
scheduled task
Published: October 1, 2024
Linked vulnerabilities : CVE-2024-21887, CVE-2023-46805, CVE-2021-44228, CVE-2017-11882, CVE-2024-21893
Downloadable IOCs: 7
Click here to see more Attack Reports