TigerJack is a threat actor that targets developers with malicious extensions that are posted on the OpenVSX registry and Microsoft’s Visual Code (VSCode) marketplace in order to steal cryptocurrency and create backdoors.
Two of the extensions are still available on OpenVSX even though they were taken out of VSCode after 17,000 downloads. The same malicious code is also republished by TigerJack on the VSCode marketplace under several identities. An independent, vendor-neutral registry is offered by OpenVSX, a community-maintained open-source extension marketplace that functions as a substitute for Microsoft’s platform.
For well-known VSCode-compatible editors like Cursor and Windsurf that are legally or technically prohibited from using VSCode, it is also the default marketplace. Since the year began, the campaign, which was discovered by Koi Security researchers, has disseminated at least 11 malicious VSCode extensions read more about Malicious crypto-stealing VSCode extensions resurface on OpenVSX.
Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions.