VS Code Malware Hits 17,000+ Developers via Extensions
A sophisticated threat actor has compromised over 17,000 developers by distributing malicious Visual Studio Code extensions that appear to be legitimate, functional tools. These trojanized extensions secretly steal source code, hijack computer resources for cryptocurrency mining, and install persistent backdoors for remote control. While Microsoft removed some of the offending extensions from its marketplace, they remain active on alternative platforms like OpenVSX. The threat actor continues to republish the same malicious code under new names, demonstrating a persistent threat to the developer community. This operation exposes significant security gaps in the extension marketplace ecosystem, leaving developers unknowingly vulnerable to attack.