Malicious crypto-stealing VSCode extensions resurface on OpenVSX

Malicious crypto-stealing VSCode extensions resurface on OpenVSX

A threat actor called TigerJack is constantly targeting developers with malicious extensions published on Microsoft's Visual Code (VSCode) marketplace and OpenVSX registry to steal cryptocurrency and plant backdoors.

TigerJack’s Malicious VSCode Extensions Signal a Growing Supply Chain Crisis in Developer Tools

A new coordinated malware campaign is exploiting the very tools developers trust most. Researchers have discovered that a threat actor known as TigerJack has been planting malicious extensions across Microsoft’s Visual Studio Code Marketplace and the OpenVSX registry, infecting thousands of machines and turning trusted developer plugins into vehicles for data theft, cryptomining, and long-term remote control.A Stealth Campaign Hidden in Plain Si…

Illicit VSCode extensions seek to pilfer cryptocurrency

Illicit VSCode extensions seek to pilfer cryptocurrency At least 11 malicious VSCode extensions have been uploaded by the threat actor TigerJack to facilitate cryptocurrency theft and backdoor injections against develope…

TigerJack’s malicious VSCode extensions mine, steal, and stay hidden

In a new disclosure, security researchers revealed that a threat actor group called TigerJack has been publishing malicious extensions on Microsoft’s Visual Studio Code (VSCode) Marketplace and the OpenVSX registry to steal source code, plant cryptominers, and maintain remote access. According to Koi Security’s findings, two of the campaign’s popular extensions – “C++ Payground” and “HTTP Format” – were removed after accumulating over 17,000 dow…

TigerJack Hackers Target Developer Marketplaces with 11 Malicious VS Code Extensions

Sophisticated Threat Actor Compromises 17,000+ Developers Through Trojan Extensions That Steal Code and Mine Cryptocurrency. Operating since early 2025 under multiple publisher accounts (ab-498, 498, and 498-00), this sophisticated campaign deploys extensions that steal source code, mine cryptocurrency, and establish remote backdoors for complete system control. A newly identified threat actor known as TigerJack has […] The post TigerJack Hacker…