Listen to this Post
Introduction
There is a quiet kind of fear that spreads through the developer world, the kind that does not rely on dramatic exploits or headline-grabbing zero-days. Instead, it hides inside something familiar, something trusted, something so ordinary that almost no one thinks twice before installing it. This time, that fear arrived through two Visual Studio Code extensions that pretended to be harmless helpers but instead opened a secret door into developers’ machines. What looked like a color theme and an AI coding assistant turned out to be carefully crafted traps capable of stealing browser sessions, passwords, crypto wallets, system information, and even live screenshots.
This story is not about an overnight campaign affecting millions. It is about a precision-based infiltration that exposes a deeper problem. Our developer tools, the very environments that shape the software world, can be weaponized. And when they are, the consequences ripple far beyond one workstation.
Main Summary
The Disguised Threat Hidden in a Trusted Marketplace
Two malicious Visual Studio Code extensions silently infiltrated the official VS Code Marketplace, posing as simple productivity tools. One looked like a color theme named Bitcoin Black. The other pretended to be an AI assistant named Codo AI. Both were published under the same developer identity, a suspicious name called BigBlack. They did not raise alarms at first. After all, the Marketplace is considered one of the safest distribution channels for developers. But this time, trust became a weapon.
Deceptively Low Install Counts That Masked a Bigger Problem
Bitcoin Black had just one installation when researchers examined the threat. Codo AI had fewer than thirty. These low numbers may look insignificant, but they highlight the chilling reality that malicious actors test their tools quietly before scaling up. The extensions existed long enough to be downloaded from the official source. They existed long enough to hide their real purpose. And that alone is an important warning.
Activation Triggers That Should Never Exist in a Theme
According to analysis by Koi Security, the Bitcoin Black extension included an activation event triggered by any user action within VS Code. Themes do not require activation triggers at all. They certainly do not require PowerShell execution privileges. Yet the extension included both. This was the first major red flag, and it revealed the attacker’s intention: persistent control over the environment.
A Shift From Visible Scripts to Hidden Payload Delivery
Early versions of the malicious extension used a PowerShell script that popped open a visible window while downloading its payload. That window could have alerted careful users. Realizing this, the attackers adapted. Newer versions used a stealthy batch script named bat.sh that leveraged curl to silently download the harmful DLL and executable. No visible window. No hint. No suspicion.
Codo AI’s Blend of Real Functionality and Malicious Code
Codo AI was even more dangerous because it worked as advertised. It used ChatGPT and DeepSeek for code assistance, which meant developers could easily mistake it for a legitimate extension. Buried inside that helpful functionality was a second component, a malicious payload delivered through the same method used by the Bitcoin Black extension.
The Lightshot Trick and the DLL Hijacking Technique
Both extensions dropped a legitimate executable of the Lightshot screenshot tool onto the victim machine. Alongside that legitimate tool, they placed a tampered DLL file. Through DLL hijacking, the malware forced Lightshot to load the malicious file instead of its legitimate library. This allowed the attackers to disguise runtime.exe as part of a normal screenshot utility.
Detection and Antivirus Analysis
VirusTotal identified the malicious DLL as harmful in twenty nine out of seventy two antivirus engines. This detection score is high enough to prove the threat but low enough to illustrate why many developers would miss it. Not all systems rely on behavioral analysis, and not all antivirus engines recognize emerging DLL hijacking patterns that abuse legitimate software.
The Secret Data Vault Named Evelyn
Once activated, the malware created a directory in the user’s AppData Local folder. Inside it, a new subfolder appeared under the name Evelyn. Into this hidden vault, the malware dumped collected data. Clipboard captures. Running processes. System specifications. WiFi credentials. Installed program lists. Screenshots. Even the subtle details that developers often forget are sensitive.
Browser Session Hijacking Through Headless Chrome and Edge
What made this malware especially dangerous was its method of hijacking browser sessions. Instead of trying to decrypt cookies directly, it launched both Chrome and Edge in headless mode. This allowed it to extract stored session cookies and take over live accounts. The attacker could borrow the victim’s identity on any platform without ever needing their login details.
Crypto Wallet Theft Targeting Phantom, Metamask, and Exodus
The malware scanned for common wallets used by developers and crypto traders. Phantom. Metamask. Exodus. It harvested private data from these applications to access stored assets. Stolen session keys and encrypted wallet data allowed attackers to bypass traditional authentication barriers.
Microsoft Contacted With No Immediate Response
BleepingComputer contacted Microsoft for comment. As of the reporting time, no official response had been provided. This silence further highlighted the lack of monitoring mechanisms capable of detecting malicious code inside Marketplace submissions.
A Growing Pattern of VS Code Extension Attacks
This incident is not isolated. Previous attacks, including the Glassworm campaign, have shown how the VS Code ecosystem is becoming a valuable target. Attackers know that developers are gatekeepers of digital infrastructure. Compromise one workstation, and you may compromise an entire software supply chain.
The Essential Lesson for Developers
The safest practice is to install extensions only from verified publishers. Even then, vigilance is essential. A legitimate extension can become malicious in a future update. Developers must treat extension installation with the same caution they apply to running unknown executables.
What Undercode Say
Why Attacking Developers Has Become More Strategic
Targeting developers is not random. Attackers understand a simple truth. A developer machine holds more value than a typical endpoint. It contains API keys, repository access tokens, build system credentials, browser logins, and crypto assets. When these machines are infected, the attacker gains a map of the digital supply chain. The two malicious extensions show increasing sophistication. They disguise themselves as harmless tools, hide inside trusted ecosystems, and rely on familiarity to bypass suspicion.
The Hidden Danger of Silent Supply Chain Entry Points
The most important part of this incident is not the malware itself. It is the distribution method. The Visual Studio Code Marketplace has millions of users. It has become an automated trust channel. Once an extension appears there, users assume it is safe. Attackers exploit that assumption. This is the same pattern seen in NPM package poisoning, PyPI supply chain attacks, and malicious Docker images. The VS Code ecosystem is simply the newest battlefield.
DLL Hijacking Shows a Shift Toward Stealth Over Brute Force
DLL hijacking is not a new technique, but its use here is clever. Attackers combined a legitimate tool with a tampered library, creating a hybrid payload that bypasses signature checks. This allows runtime.exe to act like a normal program while performing data exfiltration. The hidden nature of the process makes it harder for users to understand what changed on their system.
The Evelyn Folder Demonstrates Organized Data Harvesting
Most amateur malware dumps stolen files randomly. The structured Evelyn directory shows planning. Each stolen category has a dedicated storage point. This suggests the malware is part of a broader campaign designed for long term harvesting, later aggregation, or resale. Organized theft is always more dangerous than opportunistic theft.
Headless Browser Abuse Is a Powerful Session Weapon
Launching Chrome or Edge in headless mode is a method used in automation frameworks. Here, it becomes the attacker’s invisible key. Instead of breaking encryption or brute forcing logins, they simply borrow existing sessions. They walk straight into banking dashboards, cloud consoles, and developer platforms without detection. This is more dangerous than password theft because headless sessions can bypass multi factor authentication in many cases.
The Crypto Theft Component Signals Financial Motivation
The presence of wallet theft confirms a dual motive. Attackers want quick financial gain but also collect long term intelligence. Stealing Metamask or Phantom data lets them drain assets immediately. Collecting system credentials offers longer term value. It is a multi tiered monetization model, a growing trend in modern threat groups.
The Larger Issue: Marketplace Security is Not Enough
Microsoft’s Marketplace security checks rely heavily on static analysis. That is not enough against malware that hides inside legitimate binaries. Real security requires behavioral analysis, sandbox testing, and monitoring of update patterns. The absence of comment from Microsoft suggests that this system is not yet ready for attacks at this scale.
Why Developers Must Change Their Trust Habits
Developers treat IDE extensions as optional decorations. In reality, these extensions run code on the local machine with broad privileges. Until the community treats every extension as potential executable code, this threat will keep evolving.
Fact Checker Results
The malicious extensions Bitcoin Black and Codo AI were confirmed and analyzed by security researchers. ✅
Both extensions used DLL hijacking to deploy an infostealer disguised as Lightshot. ✅
Microsoft has not provided an official public comment at the time of reporting. ❌
Prediction
In the coming months, more attacks will target developer ecosystems as threat actors realize how much access an IDE extension can provide. 🔮 Attackers will likely refine headless browser session theft and pursue deeper integration inside supply chain pipelines. 💻 The next major breach may not come from a zero day exploit but from a trusted extension updated silently overnight.
🕵️📝✔️Let’s dive deep and fact‑check.
References:
Reported By: www.bleepingcomputer.com
Extra Source Hub (Possible Sources for article):
https://www.stackexchange.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
Bing
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon
