CyberHappenings logo
☰
Home Browse About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

TigerJack Campaign Targets Developers with Malicious VSCode Extensions

First reported
Last updated
2 unique sources, 4 articles

Summary

Hide ▲

The TigerJack campaign continues to target developers with malicious Visual Studio Code (VSCode) extensions, which have now been found to leak access tokens posing a critical software supply chain risk. The campaign has distributed at least 11 malicious VSCode extensions since the beginning of the year, with two extensions, C++ Playground and HTTP Format, removed from VSCode but remaining on OpenVSX. These extensions steal cryptocurrency, plant backdoors, and exfiltrate source code. The threat actor republishes the same malicious code under new names, making detection and removal challenging. Developers are advised to be cautious when downloading extensions from these platforms. Over 100 VSCode extensions were found to leak access tokens, allowing attackers to distribute malicious updates. The leaked tokens include AI provider secrets, cloud service provider secrets, and database secrets. Microsoft has revoked the leaked PATs and is adding secret scanning capabilities to enhance security. Organizations are recommended to develop an extension inventory and consider a centralized allowlist for extensions. A new malicious extension named susvsex with basic ransomware capabilities was published on Microsoft's official VS Code marketplace. The extension was published by 'suspublisher18' and its malicious functionality was openly advertised in its description. The extension's malicious functionality includes file theft to a remote server and encryption of all files with AES-256-CBC. The extension activates on any event, including on installation or when launching VS Code, initializing the 'extension.js' file that contains its hardcoded variables (IP, encryption keys, command-and-control address). The extension calls a function named zipUploadAndEncrypt which checks the presence of a marker text file, and starts the encryption routine. The extension creates a .ZIP archive of the files in the defined target directory and exfiltrates them to the hardcoded C2 address. All the files are then replaced with their encrypted versions. The extension polls a private GitHub repository for commands, periodically checking an 'index.html' file that uses a PAT token for authentication, and tries to execute any commands there. The owner of the repository is likely based in Azerbaijan. The extension is an overt threat and may be the result of an experiment to test Microsoft’s vetting process. Secure Annex labels susvsex an 'AI slop' with its malicious actions exposed in the README file, but notes that a few tweaks would make it far more dangerous. Microsoft ignored the report about the extension and did not remove it from the VS Code registry initially, but it was no longer available by the time the article was published.

Timeline

  1. 06.11.2025 23:52 2 articles · 4d ago

    New Malicious Extension with Ransomware Capabilities Published

    A new malicious extension named susvsex with basic ransomware capabilities was published on Microsoft's official VS Code marketplace. The extension was published by 'suspublisher18' and its malicious functionality was openly advertised in its description. The extension was uploaded on November 5, 2025, with the description 'Just testing' and the email address 'donotsupport@example[.]com.' The extension's description explicitly states it automatically zips, uploads, and encrypts files from C:\Users\Public\testing (Windows) or /tmp/testing (macOS) on first launch. The extension was removed from the official VS Code Extension Marketplace by Microsoft on November 6, 2025. The extension's TARGET_DIRECTORY is configured to be a test staging directory, but it can be easily updated with an extension release or as a command sent through the C2 channel. The extension includes extraneous comments, README files with execution instructions, and placeholder variables, indicating it is 'vibe coded' malware. The extension package accidentally included decryption tools, command and control server code, and GitHub access keys to the C2 server, which other people could use to take over the C2.

    Show sources
    Open in new tab
  2. 15.10.2025 17:16 2 articles · 26d ago

    Microsoft Revokes Leaked PATs and Adds Secret Scanning

    Microsoft revoked the leaked personal access tokens (PATs) and is adding secret scanning capabilities to block extensions with verified secrets and notify developers when secrets are detected. The cloud security firm Wiz identified over 550 validated secrets across more than 500 extensions from hundreds of distinct publishers. The 550 secrets fall under 67 distinct types of secrets, including AI provider secrets, cloud service provider secrets, and database secrets. The issue highlights the continued risks of extensions and plugins, and supply chain security in general.

    Show sources
    Open in new tab
  3. 15.10.2025 00:35 3 articles · 27d ago

    TigerJack Campaign Distributes Malicious VSCode Extensions

    Since the beginning of the year, TigerJack has distributed at least 11 malicious VSCode extensions. Two extensions, C++ Playground and HTTP Format, were removed from the VSCode marketplace but remain available on OpenVSX. These extensions steal cryptocurrency, plant backdoors, and exfiltrate source code. The threat actor republishes the same malicious code under new names, making detection and removal challenging. The extensions are disguised as legitimate tools and use various techniques to exfiltrate data and mine cryptocurrency. Developers are advised to be cautious when downloading extensions from these platforms. Over 100 VSCode extensions were found to leak access tokens, allowing attackers to distribute malicious updates. The leaked tokens include AI provider secrets, cloud service provider secrets, and database secrets. The extensions that leaked access tokens included themes and other types of extensions. The issue extends to internal or vendor-specific extensions used by organizations.

    Show sources
    Open in new tab

Information Snippets

Similar Happenings

Malicious VSX Extension SleepyDuck Targets Solidity Developers

A malicious extension named SleepyDuck was discovered in the Open VSX registry. It targets Solidity developers and includes a remote access trojan. The extension was initially published as benign but was updated to include malicious capabilities after reaching 14,000 downloads. The malware uses Ethereum contracts to update its command and control address, ensuring persistence even if the original server is taken down. It triggers when a new code editor window is opened or a .sol file is selected, gathering system information and exfiltrating it to the server. The extension has been downloaded more than 53,000 times. The malware activates on editor startup, when a Solidity file is opened, or when the user runs the Solidity compile command. It collects system data and sets up a command execution sandbox. The malware finds the fastest Ethereum RPC provider to read the smart contract with the C2 information and reads updated instructions directly from the blockchain. The extension was first published on October 31, 2025, and updated to include malicious code on November 1, 2025. It has been observed using sandbox evasion techniques and can connect to the fastest Ethereum RPC provider to maintain communication with its command server. Open VSX has announced security enhancements to make it safer for its users, including shortening token lifetimes, quickly revoking leaked credentials, automated scans, and sharing key info with VS Code about emerging threats.

Open in new tab

AdaptixC2 Framework Weaponized by Russian Ransomware Groups

AdaptixC2, an open-source command-and-control (C2) framework, has been adopted by Russian ransomware groups for advanced attacks. The framework, initially released in August 2024, includes features such as encrypted communications, command execution, and credential managers. Threat actors associated with Fog and Akira ransomware, as well as an initial access broker, have leveraged AdaptixC2 in their operations. The framework's creator, RalfHacker, has ties to Russia's criminal underground, raising concerns about its misuse. AdaptixC2 has been used in fake help desk support call scams and through AI-generated PowerShell scripts.

Open in new tab

GlassWorm malware targets OpenVSX, VS Code registries

The GlassWorm malware campaign has resurfaced on OpenVSX with three new VSCode extensions, downloaded over 10,000 times. The malware uses invisible Unicode characters to hide malicious code and targets GitHub, NPM, and OpenVSX account credentials, as well as cryptocurrency wallet data. The campaign initially impacted 49 extensions, with an estimated 35,800 downloads, though this figure includes inflated numbers due to bots and visibility-boosting tactics. The Eclipse Foundation has revoked leaked tokens and introduced security measures, but the threat actors have pivoted to GitHub and now returned to OpenVSX with updated command-and-control endpoints. The malware's global reach includes systems in the United States, South America, Europe, Asia, and a government entity in the Middle East. Koi Security has accessed the attackers' server and shared victim data with law enforcement. The threat actors have posted a fresh transaction to the Solana blockchain, providing an updated C2 endpoint for downloading the next-stage payload. The attacker's server was inadvertently exposed, revealing a partial list of victims spanning the U.S., South America, Europe, and Asia, including a major government entity from the Middle East. The threat actor is assessed to be Russian-speaking and uses the open-source browser extension C2 framework named RedExt as part of their infrastructure.

Open in new tab

FileFix Attack Evolves with Cache Smuggling Technique

A new variant of the FileFix social engineering attack uses cache smuggling to evade security software. This technique involves hiding a malicious ZIP archive within a browser's cache to bypass detection. The attack impersonates a Fortinet VPN Compliance Checker and tricks users into executing a PowerShell script through the Windows File Explorer address bar. The script extracts the malicious payload from the cache and executes it. This new variant was first observed by cybersecurity researcher P4nd3m1cb0y and detailed by Marcus Hutchins of Expel. The attack has been adopted by various threat actors, including ransomware groups. Additionally, a new ClickFix kit called the IUAM ClickFix Generator has been discovered, which automates the creation of ClickFix-style lures.

Open in new tab

Discovery of MalTerminal Malware Leveraging GPT-4 for Ransomware and Reverse Shell

Researchers have identified MalTerminal, a malware that incorporates GPT-4 for generating ransomware code and reverse shells. This marks the earliest known instance of LLM-embedded malware. The malware was presented at the LABScon 2025 security conference. MalTerminal was likely a proof-of-concept or red team tool, never deployed in the wild. It includes Python scripts and a defensive tool called FalconShield. The use of LLMs in malware represents a new challenge for cybersecurity defenses. Additionally, threat actors are using LLMs to bypass email security layers by embedding hidden prompts in phishing emails. This technique deceives AI-powered security scanners, allowing malicious emails to reach users' inboxes. The emails exploit the Follina vulnerability (CVE-2022-30190) to deliver additional malware and disable Microsoft Defender Antivirus. AI-powered site builders are also being exploited to host fake CAPTCHA pages leading to phishing websites, stealing user credentials and sensitive information.

Open in new tab