Crypto-Stealing Code: The Hilarious Misadventures of TigerJack Targeting VSCode Extensions
TigerJack is prowling the VSCode marketplace, cleverly disguising malicious extensions as legitimate tools. With names like C++ Playground and HTTP Format, these sneaky extensions steal code, mine crypto, and even open backdoors. Remember, if an extension seems too good to be true, it might just be a Tiger in disguise!
Hot Take:
Looks like TigerJack is trying to claw its way into the developers’ cryptocurrency stash while also slipping in some sneaky backdoors! Perhaps it’s time to declaw these malicious extensions and send them to the litter box where they belong.
Key Points:
- TigerJack targets developers with malicious extensions on Microsoft’s VSCode marketplace and OpenVSX registry.
- Removed extensions with 17,000 downloads are still present on OpenVSX; TigerJack republishes them under new names.
- OpenVSX serves as an alternative, community-maintained marketplace.
- Malicious extensions exfiltrate code, mine cryptocurrency, and enable arbitrary code execution.
- Koi Security researchers identified TigerJack’s multi-account operation.
Already a member? Log in here