π©βπ» Malicious VSCode extensions infected users with miners.
β’ Extension Total researcher Yuval Ronen discovered nine VSCode extensions on Microsoft's Visual Studio Code Marketplace that pose as legitimate development tools but infect users with a Monero mining cryptominer.
https://blog.extensiontotal.com/mining-in-plain-sight-the-vs-code-extension-cryptojacking-campaign-19ca12904b59?gi=8b7e3082401f
β’ Names of packages with built-in miner:
β‘ Discord Rich Presence for VS Code (by Mark H) - 189K installs;
β‘ Rojo β Roblox Studio Sync (by evaera) β 117 thousand installations;
β‘ Solidity Compiler (by VSCode Developer) - 1.3 thousand installations;
β‘ Claude AI (by Mark H);
β‘ Golang Compiler (by Mark H);
β‘ ChatGPT Agent for VSCode (by Mark H);
β‘ HTML Obfuscator (by Mark H);
β‘ Python Obfuscator for VSCode (by Mark H);
β‘ Rust Compiler for VSCode (by Mark H).
β’ Thus, the extensions have been installed more than 300 thousand times since April 4.
β’ If the user installed the malicious extension, a PowerShell script was downloaded to the victim's PC that performed multiple functions: disabling protection, persisting in the system, escalating privileges, and ultimately downloading a miner to the PC. The script thus created a scheduled task disguised as OnedriveStartup and added the malware to the Windows registry to ensure it would run at system startup. It then disabled services such as Windows Update and Update Medic and added its working directory to the Windows Defender exclusion list to avoid detection.
β’ All necessary information was passed on to Microsoft, and the company stated that they had already removed them and the publisher had been blocked from the VS Marketplace.
