Visual Studio Code Abused in Sophisticated Multistage Malware Attacks
## Cybersecurity: Evelyn Stealer Campaign Overview
Cybersecurity: Evelyn Stealer Campaign Overview
The "Evelyn Stealer" campaign has been identified as a new threat within the Visual Studio Code (VSC) extension ecosystem. This campaign is designed to compromise software developers and infiltrate enterprise environments by exploiting seemingly legitimate VSC extensions.
The campaign uses extensions such as "Bitcoin Black" and "Codo AI" to lure users. These extensions execute PowerShell and batch scripts upon activation, facilitating malware deployment. The malicious operation involves VSC extensions, DLL hijacking, process hollowing, and anti-analysis techniques.
Once the extensions are installed, they leverage the Lightshot screenshot utility with a trojanized DLL to execute malicious code. The process includes:
Sideloading of the Lightshot.dll as a legitimate component. Executing a hidden PowerShell command to download a second-stage executable, "runtime.exe".
The second-stage payload, identified as iknowyou.model, functions as a process-hollowing injector. It decrypts the Evelyn Stealer payload using AES-256-CBC encryption within a legitimate Windows process. The malware performs various environment checks and, once verified, harvests data such as:
The "Evelyn Stealer" campaign has been identified as a new threat within the Visual Studio Code (VSC) extension ecosystem.
Browser data and session information. Clipboard contents, Wi-Fi credentials, system information, installed software, and running processes.
Collected data is archived and exfiltrated over FTP to attacker-controlled infrastructure.
Organizations using VSC and third-party extensions should be aware of the potential risks associated with this campaign. The following measures are recommended:
Strictly vetting extensions and monitoring for unusual PowerShell and browser activity. Hardening systems against DLL hijacking. Applying zero-trust principles to development and build systems.
Security vendors have reported detection and blocking capabilities for Evelyn-related indicators. Continuous monitoring and proactive controls are essential to protect both code and critical business infrastructure.
Based on reporting by GBHackers.