Malicious VSCode Extension Deploys Anivia Loader and OctoRAT

In late November 2025, a sophisticated supply-chain attack leveraging the Visual Studio Code extension ecosystem was identified, highlighting how threat actors are increasingly targeting developer tools to gain persistent access to high-value systems.

On November 21, a malicious extension posing as the popular Prettier code formatter briefly appeared on the official VSCode Marketplace before being removed within four hours.

Despite its short lifespan, the extension compromised at least three systems before security researchers traced the operation back to a GitHub repository containing a multi-stage malware chain.

The fake "prettier-vscode-plus" extension was designed to look indistinguishable from the legitimate Prettier tool, trusted by millions of developers worldwide. Once installed, it initiated a carefully orchestrated infection sequence delivering the Anivia loader, which subsequently deployed OctoRAT, a fully featured remote access toolkit containing over 70 command modules for complete system compromise.

The threat actor used a GitHub repository named "vscode" to host obfuscated VBScript payloads and deployment materials. This naming choice allowed the repository to blend seamlessly into legitimate developer workflows.

Analysis of the repository’s commit history revealed active operations spanning November 20-27, during which the threat actor employed payload rotation techniques to evade detection.

The infection chain unfolds in three distinct stages. The initial vector uses a VBScript dropper to execute a PowerShell payload containing Base64-encoded, AES-encrypted malware. The dropper initializes two Windows COM objects for file operations and command execution, allowing the process to proceed silently.

The Anivia loader, the second stage, is a C# executable containing a hardcoded 228,384-byte encrypted payload. Using the AES-256 key "AniviaCryptKey2024!32ByteKey!!XX," the loader decrypts the embedded binary in memory before employing process hollowing to inject the final payload into the legitimate vbc.exe (Visual Basic Compiler) binary.

OctoRAT, the third stage, establishes persistence through the Windows Task Scheduler under the name "WindowsUpdate," scheduled to execute every minute. It immediately harvests browser credentials and exfiltrates data to the attacker’s server.

Internet-wide scanning identified at least seven active OctoRAT control panels, all hosting the distinctive "OctoRAT Center – Login" interface. Infrastructure analysis revealed connections to Railnet LLC hosting in multiple countries, with identical TLS certificates used across servers, indicating a possibly well-organized criminal operation or a malware-as-a-service offering.

OctoRAT's command set includes remote desktop control, cryptocurrency wallet theft, WiFi credential extraction, Windows Firewall disablement, and user account control bypass. The presence of "harassment functions" suggests secondary market sales to operators seeking intimidation capabilities.

Indicators of compromise include suspicious VSCode extension installations, VBS-to-PowerShell execution chains, unusual vbc.exe process activity, and outbound traffic to identified OctoRAT infrastructure. Developers are advised to implement strict extension management policies and verify extension publishers through official channels.

This campaign underscores the evolving threat landscape targeting developer ecosystems. Organizations with developer populations require elevated vigilance and enhanced endpoint detection capabilities.

Based on reporting by GBHackers.