VSCode Marketplace Purges Rogue Extensions Hatching Emerging Ransomware Threats

VSCode Marketplace Purges Rogue Extensions Hatching Emerging Ransomware Threats

Summary

• Microsoft Action: Microsoft removed two malicious extensions from the VSCode Marketplace.
• Emerging Threats: The extensions downloaded an early-stage ransomware strain.
• Security Community: Researchers at ReversingLabs found and reported them.
• Future Precautions: The case shows why extension marketplaces need closer screening.

Two bad extensions

Microsoft has removed two malicious extensions from the VSCode Marketplace, the store developers use to add features to Visual Studio Code. The extensions, published under the names ahban.shiba and ahban.cychelloworld, were found to download and run ransomware that was still in an early, test stage.

Microsoft’s response

Microsoft took the extensions down after ReversingLabs reported them. The case highlights the risk that comes with open marketplaces where anyone can publish.

Developers often install extensions with little scrutiny. That is exactly what attackers count on.

How the extensions worked

Once installed, the extensions ran a PowerShell command that fetched and executed a payload from a remote server. The payload encrypted files in a single test folder on the user’s desktop and showed a ransom note demanding 1 ShibaCoin, with no wallet address given.

The limited scope suggests the author was still testing. But the delivery method worked, and a finished version could do real damage.

Researchers’ role

Security researchers spotted the extensions and reported them, which led to their removal. Independent scanning of open-source packages and extensions catches threats that marketplace checks miss.

Marketplaces depend on reports like these.

What developers should do

Install extensions only from publishers you trust, check download counts and reviews, and remove extensions you no longer use. Organizations can restrict which extensions developers are allowed to install.

Developer machines often hold source code, credentials and access to production systems. That makes them valuable targets.

What to watch

Watch whether Microsoft tightens screening for VSCode extensions and whether attackers return with more polished versions of this approach.

Developer tools are now part of the attack surface. Treat them that way.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.