VSCode Marketplace Removes Two Extensions Deploying Early-Stage Ransomware
Researchers studying cybersecurity have discovered two malicious extensions in the Visual Studio Code (VSCode) Marketplace that are intended to infect users with ransomware that is currently in development.
"Ahban.shiba" and "ahban.cychelloworld," the extensions, have now been removed by the marketplace's administrators.
According to ReversingLabs, both extensions contain code intended to launch a PowerShell command, which subsequently retrieves and runs a PowerShell-script payload from a command-and-control (C2) server.
Since the payload only encrypts files in the "testShiba" folder on the victim's Windows desktop, it is believed to be ransomware in its early stages of development read more about VSCode Marketplace Removes Two Extensions Deploying Early-Stage Ransomware.
Get ...