A new wave of malicious Visual Studio Code (VS Code) extensions has been uncovered, exploiting weak registry and process controls in Windows to steal sensitive developer data.
Two extensions, Bitcoin Black and Codo AI, disguised as harmless developer tools, were found to execute hidden scripts that exfiltrate system credentials, browser sessions, and even screen captures to attacker-controlled servers.
Malicious Extensions Masquerading as Legitimate Tools
The Bitcoin Black extension, advertised as a “premium dark theme inspired by Bitcoin,” was far from a simple color customization.
Unlike legitimate VS Code themes that rely solely on harmless JSON files, Bitcoin Black contained activation events and an embedded PowerShell script that executed every time the editor was used.
This script downloaded malicious payloads from remote servers and accessed stored Wi-Fi passwords and other system information via registry queries.
The second extension, Codo AI, served as an AI assistant for coding, integrating ChatGPT and DeepSeek.
While it provided limited real functionality, deeper analysis revealed obfuscated instructions in the JavaScript file extension.js designed to deploy a background installer.
This installer delivered an infostealer using a technique known as DLL hijacking, leveraging a legitimate Windows-signed binary to load a malicious dynamic link library file secretly.
Screen Capture and Session Hijacking
Both Bitcoin Black and Codo AI ultimately installed a modified version of the legitimate Lightshot screenshot utility bundled with a custom Lightshot.dll file.
Once executed, the tool silently captured desktop screenshots, clipboard data, running processes, and saved WiFi credentials from the Windows registry.
The malware also launched Chrome and Edge browsers in invisible “headless” sessions, allowing it to steal session cookies and active logins, a technique tracked as MITRE ATT&CK T1539 (Steal Web Session Cookie) and T1574.001 (DLL Side-Loading).
The stolen data was exfiltrated to the attacker’s command-and-control (C2) infrastructure, including the domain syn1112223334445556667778889990.org and fallback server server09.mentality.cloud:40207.
Researchers noted the malware used a mutex string, COOL_SCREENSHOT_MUTEX_YARRRto ensure only one instance runs at a time—a common tactic to maintain persistence.
Security analysts at Koi Security, who discovered the threat, reported multiple versions of the extensions across releases 2.5.0 and 3.3.0, indicating continuous refinement.
The malicious actors simplified their scripts over time, hiding command windows and introducing checks to prevent re-execution.
Although Microsoft has removed the extensions from the VS Code Marketplace, Codo AI was still live during early analysis. Developers are strongly advised to review installed extensions and immediately disable any from the publisher “BigBlack”.
As this campaign shows, even trusted developer platforms can become vectors for highly targeted infostealers.
Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates
 extensions has been uncovered, exploiting weak.){kind=link}