Open VSX Extension Delivers RAT and Stealer via GitHub Downloader
An Open VSX extension, known as KhangNghiem/fast-draft, has been identified as distributing a remote access trojan and infostealer via GitHub. This extension, which has been downloaded over 26,000 times as of March 17, 2026, contained several malicious…
An Open VSX extension, known as KhangNghiem/fast-draft, has been identified as distributing a remote access trojan and infostealer via GitHub. This extension, which has been downloaded over 26,000 times as of March 17, 2026, contained several malicious releases that utilized a GitHub-hosted downloader to retrieve a second-stage payload from the BlokTrooper/extension repository.
The versions confirmed to be malicious include 0.10.89, 0.10.105, 0.10.106, and 0.10.112. Releases up to version 0.10.88 were clean, while subsequent versions alternated between benign and backdoored builds. Notably, version 0.10.111 is clean despite being positioned between two malicious versions, 0.10.106 and 0.10.112. The latest checked version, 0.10.135, does not exhibit the same malicious loader logic.
This inconsistent pattern suggests a possible compromise of the publisher's account or a stolen release token, rather than intentional malicious activity by the maintainer.
Researchers disclosed the issue to the maintainer via a GitHub issue on March 12, 2026; however, the report remains open and unanswered. The attack initiates within the extension’s activation logic, where it connects to raw.githubusercontent.com/BlokTrooper/extension and directs the response into a shell, treating GitHub as a remote code execution delivery channel.
An Open VSX extension, known as KhangNghiem/fast-draft, has been identified as distributing a remote access trojan and infostealer via GitHub.
Version 0.10.89 retrieves platform-specific scripts for execution, while later malicious versions conceal the behavior behind an icons/${platform} fetch, binding it to startup activation. This approach likely aims to blend with standard operations and evade detection during editor initialization.
The malicious payload is a compact attack framework that executes four parallel modules:
A Socket.IO-based RAT enabling remote desktop-style control. A browser and crypto wallet stealer targeting various browsers and wallet extensions. A file exfiltration component focused on developer workstations. A clipboard surveillance routine.
These modules are configured to communicate with a C2 server at IP address 195.201.104.53, utilizing ports 6931, 6936, and 6939.
Security researchers manually inspected several versions for indicators of compromise, revealing a gap between clean and malicious builds. The evidence points toward a compromised publisher or stolen token as the likely cause of the malicious releases. The disclosed issue remains unresolved, raising concerns about the security of the extension distribution process.
Based on reporting by GBHackers.