Darcula extension on the VSCode Marketplace (Check Point) This extension had the most circulation by far, downloaded over 45,000 times. While the extension did not contain other malicious activity, it is not typical behavior associated with a theme pack. ‘Theme Darcula dark’ – Described as “an attempt to improve Dracula colors consistency on VS Code,” this extension was used to steal basic information about the developer’s system, including hostname, operating system, CPU platform, total memory, and information about the CPU. The malicious extensions discovered by Check Point researchers are the following: Microsoft also operates an extensions market for the IDE called the VSCode Marketplace, which offers over 50,000 add-ons that extend the application’s functionality and provide more customization options. Visual Studio Code (VSC) is a source-code editor published by Microsoft and used by a significant percentage of professional software developers worldwide. Malicious cases on the VSCode Marketplace However, any software developers still using the malicious extensions must manually remove them from their systems and run a complete scan to detect any remnants of the infection. The extensions were discovered and reported on May 4, 2023, and they were subsequently removed from the VSCode marketplace on May 14, 2023. *Content borrowed from .Ĭybercriminals are starting to target Microsoft’s VSCode Marketplace, uploading three malicious Visual Studio extensions that Windows developers downloaded 46,600 times.Īccording to Check Point, whose analysts discovered the malicious extensions and reported them to Microsoft, the malware enabled the threat actors to steal credentials, system information, and establish a remote shell on the victim’s machine.

Download webstorm vscode