Malicious VS Code on Microsoft Registry Steals WiFi Passwords and Captures Screens
## Cybersecurity: Malware Campaign Targeting Developers
Cybersecurity: Malware Campaign Targeting Developers
Security researchers at Koi Security have identified a sophisticated malware campaign targeting developers via the Visual Studio Code Marketplace.
The attack utilizes two extensions, a dark theme and an AI assistant, to deploy an infostealer capable of capturing screenshots, hijacking browser sessions, and stealing Wi-Fi passwords.
The malicious extensions, named "Bitcoin Black" and "Codo AI," originate from the same publisher but use different social engineering tactics to compromise developer environments.
"Bitcoin Black" is disguised as a premium dark theme with gold accents. Unlike legitimate VS Code themes, which are typically harmless JSON files , this extension suspiciously includes a generic activation event, allowing it to execute a malicious PowerShell script whenever the editor is used.
Conversely, "Codo AI" functions as a coding assistant integrated with ChatGPT and DeepSeek, offering genuine utility while the malware operates in the background.
Security researchers at Koi Security have identified a sophisticated malware campaign targeting developers via the Visual Studio Code Marketplace.
Koi Security's analysis indicates that the threat actor is refining their delivery code. Early versions (v2.5.0) used complex extraction methods and password-protected ZIP files, which sometimes exposed PowerShell windows to users. By version 3.3.0, the attack became more streamlined, utilizing a clean batch script with hidden windows.
The attack employs DLL Hijacking (MITRE T1574.001). The extensions deploy a legitimate, digitally signed executable for the screenshot tool "Lightshot." When Lightshot.exe is launched, it automatically loads a malicious DLL file, allowing the malware to bypass security filters by hiding within a trusted process.
Once activated, the malware aggressively collects data, creating a staging directory in the user’s AppData folder to gather:
Screenshots: Capturing the developer's code, emails, and private messages. Credentials: Stealing stored Wi-Fi passwords and clipboard contents. Web Sessions: Launching headless versions of Chrome and Edge to hijack cookies and browser sessions.
The malware communicates with a Command and Control (C2) server and uses the mutex COOL_SCREENSHOT_MUTEX_YARRR to prevent duplicate infections.
This campaign demonstrates A/B testing on the developer community, targeting crypto-enthusiasts and productivity-seekers. Despite some amateur mistakes, such as leaving comments in the source code, the use of signed binaries makes this a credible threat.
As of detection, Codo AI was still available on the marketplace. Developers are advised to audit their installed extensions and remain vigilant against supply chain attacks within the VS Code ecosystem.
Based on reporting by GBHackers.