Malware Alert - Backdoored Open VSX Extension Discovered
Basically, a trusted software tool was secretly used to install dangerous malware on computers.
A popular code editor extension was found backdoored, silently installing malware on developer machines. Over 26,000 users are at risk. Immediate action is required to secure affected systems.
How It Works
The fast-draft extension, available on the Open VSX registry, was compromised to deliver malware. Specifically, versions 0.10.89, 0.10.105, 0.10.106, and 0.10.112 contained malicious code. This code allowed the extension to reach out to a GitHub repository controlled by a threat actor named BlokTrooper. Once installed, the extension executed a shell command that downloaded and ran a remote access trojan (RAT) and a full infostealer on the victim's machine.
This malware operates in a stealthy manner, without any visible warnings to users. Once activated, it pulls a ZIP archive containing multiple attack modules, each designed to target different types of sensitive information. This includes browser credentials, cryptocurrency wallet data, and even clipboard contents, all while the user remains unaware of the ongoing attack.
Who's Being Targeted
The attack primarily affects developers who installed the compromised versions of the fast-draft extension. With over 26,594 downloads, the potential impact is significant. Developers often trust their tools, making them prime targets for supply chain attacks. The malware exploits this trust by hiding within a legitimate extension that many developers rely on daily.
The compromised extension's ability to operate across multiple platforms, including Windows, macOS, and Linux, broadens its reach. This means that any developer using the affected versions could be at risk, regardless of their operating system.
Signs of Infection
Detecting this malware can be challenging due to its stealthy nature. However, users may notice unusual behavior on their machines, such as unexpected network activity or system performance issues. If you have installed versions 0.10.89, 0.10.105, 0.10.106, or 0.10.112, you should be particularly vigilant.
The malware's modules work simultaneously, making it capable of executing multiple attacks at once. This includes stealing passwords from browsers like Chrome and Edge, targeting cryptocurrency wallets, and scanning local files for sensitive information. If you suspect infection, immediate action is crucial.
How to Protect Yourself
Developers should take immediate steps to secure their systems. First, uninstall any versions of the fast-draft extension that match the compromised versions. Next, rotate all stored credentials, including passwords and cryptocurrency wallet seed phrases, to mitigate potential damage.
Network teams should also monitor outbound traffic to the command-and-control server at 195.201.104.53 on ports 6931, 6936, and 6939. Flagging any requests to the GitHub repository used by the attacker can help identify further malicious activity. Staying informed about updates and security practices is essential to prevent future attacks.
Cyber Security News