Ransomware in VSCode

Summary

Malicious extensions bypassed security, downloading ransomware onto users’ PCs. Microsoft removed the extensions but only after researchers reported them, despite earlier warnings. This incident highlights vulnerabilities in Microsoft’s extension vetting process.

Explore the data solution with built-in protection against ransomware TrueNAS.

** Main Story**

Ransomware Lurks in VSCode Extensions, Exposing Security Gaps

In a concerning development for software developers, two malicious extensions on the Visual Studio Code (VSCode) Marketplace were recently discovered distributing early-stage ransomware. This discovery has raised serious questions about the effectiveness of Microsoft’s security review process for VSCode extensions. The extensions, “ahban.shiba” and “ahban.cychelloworld,” contained PowerShell commands that downloaded and executed ransomware from a remote server hosted on Amazon AWS.

The extensions, uploaded in late 2024 and early 2025, bypassed Microsoft’s security checks and remained available for several months. This incident exposes a critical vulnerability in the software supply chain, demonstrating how malicious actors can exploit trusted platforms like the VSCode Marketplace to distribute malware. Although the ransomware in this case appeared to be in a developmental stage, targeting only a specific test folder on the user’s desktop, the incident serves as a stark reminder of the potential for more widespread attacks.

Unveiling the Malicious Code

The ransomware, deployed via the two malicious extensions, employed a straightforward but effective attack strategy. The extensions contained embedded PowerShell commands that initiated the download of a ransomware script from a remote server upon installation.

The downloaded script then encrypted files located in the “C:\users\%username%\Desktop\testShiba” folder. Upon completion of the encryption process, the script displayed a Windows alert, mimicking a typical ransom demand: “Your files have been encrypted. Pay 1 ShibaCoin to ShibaWallet to recover them.”

Delayed Response Raises Concerns

While Microsoft promptly removed the extensions after researchers from ReversingLabs reported them, concerns remain about the timeliness of their response. Security researcher Italy Kruk of ExtensionTotal revealed that their automated scanning system had detected the malicious extensions much earlier and notified Microsoft in November 2024.

Microsoft, however, failed to take action for several months, leaving the extensions available for download and potentially exposing numerous users to the ransomware. This delayed response highlights gaps in Microsoft’s security protocols and underscores the need for more proactive measures to prevent malicious extensions from reaching the VSCode Marketplace.

Microsoft’s Balancing Act

This incident is not the first time Microsoft’s handling of VSCode extensions has come under scrutiny. While their delayed response to the ransomware extensions raises concerns about their security review process, they have also faced criticism for overzealous removal of extensions in the past. In a recent incident, Microsoft removed popular VSCode themes used by millions after reports of suspicious code, only to later reinstate them after determining they were not malicious. These incidents highlight the difficult balance Microsoft must strike between ensuring the security of the VSCode Marketplace and avoiding disruption for users of legitimate extensions.

The Need for Enhanced Security

This incident underscores the importance of robust security measures for code editor extensions. Developers rely on extensions to enhance their productivity and streamline their workflows. Therefore, ensuring the security of these extensions is paramount to protecting the integrity of the software development process. Microsoft needs to strengthen its security review process for VSCode extensions to prevent similar incidents from occurring in the future. This may include more thorough automated scanning, manual review of extensions, and faster response times to reported threats.

Protecting Your System

For developers using VSCode, it is crucial to be vigilant about the extensions they install. Carefully scrutinize the permissions requested by extensions, avoid installing extensions from untrusted sources, and keep your VSCode installation and extensions updated. Regularly backing up your data is also essential to mitigate the impact of any potential ransomware attacks.

This incident serves as a wake-up call for the software development community. The increasing reliance on extensions underscores the need for robust security measures throughout the software supply chain. By taking proactive steps to enhance security and remaining vigilant against potential threats, developers can help mitigate the risk of malicious extensions compromising their systems.