Malicious VSCode extensions infect Windows with cryptominers
On Microsoft's Visual Studio Code Marketplace, nine VSCode extensions masquerade as genuine development tools but infect users with the XMRig cryptominer, which mines Ethereum and Monero.
The well-known code editor Microsoft VSCode lets users add extensions to increase the program's functionality. Microsoft's VSCode Marketplace, an online resource for developers to locate and install add-ons, is where developers may get these extensions.
On April 4, 2025, researcher Yuval Ronen of ExtensionTotal discovered nine VSCode extensions that were posted on Microsoft's webpage.
Since April 4, the extensions have already accumulated over 300,000 installs, according to the marketplace. These figures are probably exaggerated to make the extensions seem more popular and legitimate, which will...


