![\"\"](\"https:\/\/www.newsbeep.com\/ie\/wp-content\/uploads\/2025\/12\/software-malware.jpg\")
<\/a><\/p>\nCybersecurity researchers have discovered two new extensions on Microsoft Visual Studio Code (VS Code) Marketplace that are designed to infect developer machines with stealer malware.<\/p>\n
The VS Code extensions masquerade as a premium dark theme and an artificial intelligence (AI)-powered coding assistant, but, in actuality, harbor covert functionality to download additional payloads, take screenshots, and siphon data. The captured information is then sent to an attacker-controlled server.<\/p>\n
“Your code. Your emails. Your Slack DMs. Whatever’s on your screen, they’re seeing it too,” Koi Security’s Idan Dardikman said<\/a>. “And that’s just the start. It also steals your WiFi passwords, reads your clipboard, and hijacks your browser sessions.”<\/p>\n The names of the extensions are below –<\/p>\n BigBlack.bitcoin-black (16 installs) – Removed by Microsoft on December 5, 2025 Microsoft’s list of removed extensions from the Marketplace shows<\/a> that the company also removed a third package named “BigBlack.mrbigblacktheme” from the same publisher for containing malware. <\/p>\n While “BigBlack.bitcoin-black” activates on every VS Code action, Codo AI embeds its malicious functionality within a working tool, thereby allowing it to bypass detection.<\/p>\n Earlier versions of the extensions came with the ability to execute a PowerShell script to download a password-protected ZIP archive from an external server (“syn1112223334445556667778889990[.]org”) and extract from it the main payload using four different methods: Windows native Expand-Archive, .NET System.IO.Compression, DotNetZip, and 7-Zip (if installed).<\/p>\n That said, the attacker is said to have inadvertently shipped a version that created a visible PowerShell window and could have alerted the user. Subsequent iterations, however, have been found to hide the window and streamline the entire process by switching to a batch script that uses a curl command to download the executable and DLL.<\/p>\n The executable is the legitimate Lightshot binary that’s used to load the rogue DLL (“Lightshot.dll”) via DLL hijacking, which proceeds to gather clipboard contents, a list of installed apps, running processes, desktop screenshots, stored Wi-Fi credentials, and detailed system information. It also launches Google Chrome and Microsoft Edge in headless mode to grab stored cookies and hijack user sessions.<\/p>\n “A developer could install what looks like a harmless theme or a useful AI tool, and within seconds their WiFi passwords, clipboard contents, and browser sessions are being exfiltrated to a remote server,” Dardikman said.<\/p>\n The disclosure comes as Socket said it identified malicious packages across the Go, npm, and Rust ecosystems that are capable of harvesting sensitive data –<\/p>\n Go packages named “github[.]com\/bpoorman\/uuid” and “github[.]com\/bpoorman\/uid” that have been available since 2021 and typosquat trusted UUID libraries (“github[.]com\/google\/uuid” and “github[.]com\/pborman\/uuid”) to exfiltrate data<\/a> to a paste site called dpaste when an application explicitly invokes a supposed helper function named “valid” along with the information to be validated. “Finch-rust acts as a malware loader; it contains mostly legitimate code copied from the legitimate finch package but includes a single malicious line that loads and executes the sha-rust payload,” Socket researcher Kush Pandya said. “This separation of concerns makes detection harder: finch-rust looks benign in isolation, while sha-rust contains the actual malware.”<\/p>\n","protected":false},"excerpt":{"rendered":"\ue802Dec 09, 2025\ue804Ravie LakshmananMalware \/ Threat Analysis Cybersecurity researchers have discovered two new extensions on Microsoft Visual Studio…\n","protected":false},"author":2,"featured_media":182621,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[12824,19498,19491,19490,19492,19493,19494,5703,19495,19496,19500,61,14336,60,19501,19499,19497,80,19502],"class_list":["post-182620","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-computer-security","tag-cyber-attacks","tag-cyber-news","tag-cyber-security-news","tag-cyber-security-news-today","tag-cyber-security-updates","tag-cyber-updates","tag-data-breach","tag-hacker-news","tag-hacking-news","tag-how-to-hack","tag-ie","tag-information-security","tag-ireland","tag-network-security","tag-ransomware-malware","tag-software-vulnerability","tag-technology","tag-the-hacker-news"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts\/182620","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/comments?post=182620"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts\/182620\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/media\/182621"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/media?parent=182620"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/categories?post=182620"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/tags?post=182620"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}<\/a><\/p>\n
\nBigBlack.codo-ai (25 installs) – Removed by Microsoft on December 8, 2025<\/p>\n<\/a><\/p>\n<\/a><\/p>\n
\nA set of 420 unique npm packages<\/a> published by a likely French-speaking threat actor that follows a consistent naming pattern including “elf-stats-*,” some of which contain code to execute a reverse shell and exfiltrate files to a Pipedream endpoint.
\nA Rust crate named finch-rust published by faceless, that impersonates<\/a> the legitimate bioinformatics tool “finch” and serves as a loader for a malicious payload through a credential-stealing package known as “sha-rust” when a developer uses the library’s sketch serialization functionality.<\/p>\n