Researchers Expose Security Flaws in Visual Studio Code Marketplace with Malicious Extensions

Researchers uncovered another vulnerability in Microsoft Cyber security targeting Visual Studio code

Researchers have uncovered another vulnerability in Microsoft’s cybersecurity practices, this time targeting the Visual Studio Code (VS Code) marketplace. VS Code, a popular, free, open-source code editor with 14 million users, is known for its cross-platform support, extensibility, and built-in features like Git support and debugging.

Dracula Experiment Strike 

According to BleepingComputer, researchers Amit Assaraf, Itay Kruk, and Idan Dardikman conducted an experiment to see how easily VS Code users could be compromised. They created a typosquatted version of the “Dracula Official” theme, naming it “Darcula,” and established a domain, darculatheme.com, to become a verified publisher on the marketplace. The “Darcula” theme functioned similarly to the legitimate one but included malicious code to steal sensitive information.

The experiment was alarmingly successful, with numerous companies inadvertently downloading the malicious theme. Among the victims was a publicly listed company valued at $483 billion, a national justice court network, and several large security firms. The researchers then explored whether other malicious extensions were present and discovered 1,283 extensions with known malicious code, collectively downloaded 229 million times. Additionally, they found 8,161 extensions communicating with hardcoded IP addresses, 1,452 running unknown executables, and 2,304 using another publisher's GitHub repository.