Mining in Plain Sight: The VS Code Extension Cryptojacking Campaign
A sophisticated cryptomining campaign has been discovered targeting developers through seemingly legitimate VS Code extensions. The campaign, potentially reaching over one million installations, involves fake extensions published by three different authors. These extensions secretly download a PowerShell script that disables Windows security, establishes persistence, and installs an XMRig cryptominer. The most successful fake extension gained 189K installs. The attackers created a multi-stage attack, even installing legitimate extensions they impersonated to avoid suspicion. The campaign published ten different malicious extensions, with the top three showing unusually high install counts, suggesting artificial inflation. The extensions share identical code and communicate with the same C2 server. The PowerShell script sets up persistence mechanisms, disables Windows security services, and attempts privilege escalation.
Pulse ID: 67f4ffb4bf1e842db102d8bd
Pulse Link: https://otx.alienvault.com/pulse/67f4ffb4bf1e842db102d8bd
Pulse Author: AlienVault
Created: 2025-04-08 10:51:32
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
️
Selenium Grid Targeted for