Beware of Malicious VSCode Extensions Stealing Passwords and Enabling Backdoors
Malicious extensions were uploaded to Microsoft's VSCode Marketplace, which were downloaded 46,600 times by Windows developers. The malware enabled threat actors to steal credentials, system information, and establish a remote shell on the victim's machine. While the extensions were removed, developers must manually remove them from their systems and run a complete scan to detect any remnants of the infection. Users are advised to only install extensions from trusted publishers with many downloads and community ratings, read user reviews, and always inspect the extension's source code before installing it.