Threat Actors Using Malicious VSCode Extension to Deploy Anivia Loader and OctoRAT

A malicious Visual Studio Code extension, masquerading as a legitimate tool, has been identified in a supply chain attack targeting developers using Visual Studio Code.

The extension, named prettier-vscode-plus , impersonated the popular Prettier formatter and was briefly available in the official VSCode Marketplace before its removal.

Upon installation, it retrieved staged scripts from a GitHub repository named vscode under the account biwwwwwwwwwww .

The extension seamlessly integrated into regular developer workflows, executing its payload when a project was opened. It downloaded an obfuscated VBScript file that acted as the initial dropper.

This script installed a PowerShell loader in the temporary folder and executed it with policy bypass parameters, all while remaining inconspicuous to the user.

Security analysts from Hunt.io discovered this activity by tracing suspicious VBScript downloads to the vscode repository, correlating them with the short-lived marketplace entry.

This incident resulted in the deployment of OctoRAT, a comprehensive remote access tool facilitated by an intermediary component known as the Anivia loader.

These components enable code execution, data theft from browsers and wallets, and remote desktop control on developer systems.

Despite the limited number of installations, the targets were significant, having access to source code and production systems.

The infection process begins with a VBScript dropper that creates a random PowerShell file in the temporary path, containing a Base64-encoded AES payload.

The script employs COM objects like WScript.Shell to execute the loader without user notifications. A simplified version of the persistence task established by OctoRAT is as follows:

schtasks.exe /create /tn "WindowsUpdate" /tr "" /sc minute /mo 1 /f

The PowerShell loader decrypts the embedded blob using AES-256 in CBC mode and executes the outcome directly in memory.

Anivia subsequently assumes control, storing its encrypted payload in a byte array and using a hard-coded key to decrypt a portable executable.

This payload is injected into the trusted vbc.exe process via process hollowing, enabling it to evade typical endpoint detection.

Following this, OctoRAT initiates, configures the WindowsUpdate task for recurring startup, and establishes an encrypted command channel to attacker-controlled servers.

This comprehensive technical analysis illustrates how a single fake extension can facilitate a complete compromise in a few steps.

Based on reporting by Cyber Security News.