![\"Malicious](\"https:\/\/www.newsbeep.com\/ca\/wp-content\/uploads\/2025\/12\/VSCode_bw.jpg\")
<\/p>\n<\/p>\n
Two malicious extensions on Microsoft’s Visual Studio Code Marketplace infect developers’ machines with information-stealing malware that can take screenshots, steal credentials, crypto wallets, and hijack browser sessions.<\/p>\n
The marketplace hosts extensions for the popular VSCode integrated development environment (IDE) to extend functionality or add customization options.<\/p>\n
The two malicious extensions, called Bitcoin Black and Codo AI, masquerade\u00a0as a color theme and an AI assistant,\u00a0respectively, and were published under the developer name\u00a0‘BigBlack.’\u00a0<\/p>\n
At the time of writing, Codo AI was still present in the marketplace, although it counted fewer than 30 downloads.\u00a0Bitcoin Black’s counter showed only one install.<\/p>\n
![\"CodoAI](\"https:\/\/www.newsbeep.com\/ca\/wp-content\/uploads\/2025\/12\/codoai.jpg\")
Codo AI on VSCode Market
Source: BleepingComputer.com<\/p>\n
According to Koi Security, the Bitcoin Black malicious extension features a “*” activation event that executes on every VSCode action. It can also run PowerShell code, something that a theme does not need and should be a red flag.<\/p>\n
In older versions, Bitcoin Black used a PowerShell script to download a password-protected archived payload, which created a visible PowerShell window and could have warned the user.<\/p>\n
In more recent versions, though, the process switched to a batch script (bat.sh) that calls ‘curl’ to download a DLL file and an executable, and the activity occurs with the window hidden.<\/p>\n
![\"Malicious](\"https:\/\/www.newsbeep.com\/ca\/wp-content\/uploads\/2025\/12\/payload.jpg\")
Malicious payload from bat.sh
Source: Koi Security<\/p>\n
Idan Dardikman of Koi Security says that Codo AI has code assistance functionality via ChatGPT or DeepSeek, but also includes a malicious section.<\/p>\n
Both extensions deliver a legitimate executable of the Lightshot screenshot tool and a malicious DLL file that is loaded via the DLL hijacking technique to deploy the infostealer under the name\u00a0runtime.exe.<\/p>\n
The malicious DLL is flagged as a threat by\u00a029 out of the 72 antivirus engines on Virus Total, the researcher notes in a report<\/a> today.<\/p>\n The malware creates a directory in ‘%APPDATA%\\Local\\’ and creates a directory called Evelyn\u00a0to store stolen data: details about\u00a0running processes, clipboard content, WiFi credentials, system information, screenshots, a list of installed programs, and running processes.<\/p>\n To steal cookies and hijack user sessions, the malware launches\u00a0the Chrome and Edge browsers in headless mode so it can snatch stored cookies and hijack user sessions.<\/p>\n The malware also steals cryptocurrency wallets like Phantom, Metamask, Exodus. It looks for passwords and credentials\u00a0<\/p>\n BleepingComputer has contacted Microsoft about the presence of the extensions in the marketplace, but a comment wasn’t immediately available.<\/p>\n Malicious VS Code extensions\u00a0have been pushed to platforms providing\u00a0extensions with VS Code IDEs, such as\u00a0OpenVSX and\u00a0Visual Studio Code,\u00a0one of the most notable campaigns being Glassworm<\/a>.<\/p>\n Developers can minimize the risks of malicious VSCode extensions by installing projects only from reputable publishers.<\/p>\n![\"\"](\"https:\/\/www.newsbeep.com\/ca\/wp-content\/uploads\/2025\/12\/EvelynInfostealer_storage.png\")
Evelyn directory created to store stolen data
source: BleepingComputer<\/p>\n
![\"tines\"](\"https:\/\/www.newsbeep.com\/ca\/wp-content\/uploads\/2025\/12\/tines-keyhole.jpg\")
<\/a><\/p>\n