Microsoft Visual Studio Code

Cybersecurity researchers flagged a malicious Microsoft Visual Studio Code (VS Code) extension named Solidity Pro ("solidity-pro"). This extension was observed delivering a browser wallet and credential stealer. The specific extensions identified as malicious include helper-beeps.solidity-pro and web3devtoolsx.solidity-pro.

Cybersecurity researchers disclosed a one-click attack via Microsoft Visual Studio Code that can steal GitHub OAuth tokens, allowing attackers to read and write to user repositories, including private ones. The attack exploits GitHub's GitHub.dev feature, enabling token theft through a malicious link click.

GitHub confirmed that a breach of its internal repositories resulted from a compromised employee device running a poisoned version of the Nx Console VS Code extension. The nrwl.angular-console extension was compromised after one of the Nx team's developer systems was hacked.

A compromised version of the Nx Console extension was published to the Microsoft Visual Studio Code Marketplace, targeting VS Code developers with a credential stealer. The affected extension is rwl.angular-console, version 18.95.0, with over 2.2 million installations. Cybersecurity researchers have flagged this compromise.

A cyber campaign targeting Chinese-speaking individuals uses a trojanized version of SumatraPDF to deploy the AdaptixC2 Beacon malware, leveraging Microsoft Visual Studio Code tunnels for remote access. Zscaler ThreatLabz attributed the attack with high confidence to the Tropic Trooper threat group.