Poisoned Pipeline / Incidents / AS63
DarkGPT / Codo-AI / bitcoin-auto-trading VS Code extensions
VS Code / IDEWindows softwareGit / GitHubmacOS software
SafeDep analyzed Visual Studio Marketplace extensions EffetMer.darkgpt
(1.2.0 / 1.2.2), BigBlack.codo-ai 1.0.0 and ozz3dev.bitcoin-auto-trading
1.2.0. On activate, extension.js launched scripts/run.bat via hidden
PowerShell. The batch file downloaded Lightshot.exe (a signed Windows
binary) and Lightshot.dll from syn1112223334445556667778889990.org and
ran the exe so it DLL-hijacked the signed host. The DLL then fetched a
further payload. Windows-only. Related analysis by Koi Security.
Mapped techniques
- T0109 Publish malicious artifact
- T0154 Malicious IDE extension
- T0151 Installation scripts
- T0208 Compromise code-signing identity
- T0184 Harvesting sensitive information from files
supply-chain malicious vscode marketplace extensions
Three extensions on the Visual Studio Marketplace.
activate() spawned hidden PowerShell to run run.bat.
run.bat dropped Lightshot.exe / Lightshot.dll from a remote host.
Payload hid behind a signed Lightshot.exe via DLL hijack.
Downstream stealer targeted developer-machine data.