VSCode Marketplace Removes Two Extensions Deploying Early-Stage Ransomware

Mar 24, 2025Ravie LakshmananMalware / Encryption

Cybersecurity researchers have uncovered two malicious extensions in the Visual Studio Code (VSCode) Marketplace that are designed to deploy ransomware that’s under development to its users.

The extensions, named “ahban.shiba” and “ahban.cychelloworld,” have since been taken down by the marketplace maintainers.

Both the extensions, per ReversingLabs, incorporate code that’s designed to invoke a PowerShell command, which then grabs a PowerShell-script payload from a command-and-control (C2) server and executes it.

The payload is suspected to be ransomware in early-stage development, only encrypting files in a folder called “testShiba” on the victim’s Windows desktop.

Once the files are encrypted, the PowerShell payload displays a message, stating “Your files have been encrypted. Pay 1 ShibaCoin to ShibaWallet to recover them.”

However, no other instructions or cryptocurrency wallet addresses are provided to the victims, another indication that the malware is likely under development by the threat actors.

The development comes a couple of months after the software supply chain security firm flagged several malicious extensions, some of which masqueraded as Zoom, but harbored functionality to download an unknown second-stage payload from a remote server.

Last week, Socket detailed a malicious Maven package impersonating the scribejava-core OAuth library that secretly harvests and exfiltrates OAuth credentials on the fifteenth day of each month, highlighting a time-based trigger mechanism that’s designed to evade detection.

The library was uploaded to Maven Central on January 25, 2024. It continues to be available for download from the repository.

“Attackers used typosquatting — creating a nearly identical name to trick developers into adding the malicious package,” security researcher Kush Pandya said. “Interestingly, this malicious package has six dependent packages.”

“All of them are typosquatting legitimate packages but share the same groupId (io.github.leetcrunch) instead of the real namespace (com.github.scribejava).”

In adopting this approach, the idea is to boost the malicious library’s perceived legitimacy, thereby increasing the chances that a developer would download and use it in their projects.

Upgrade your audio game with the Logitech for Creators Blue Yeti USB Microphone. With over 33,730 ratings and an impressive 4.6 out of 5 stars, it’s no wonder this is an Amazon’s Choice product. Recently, 5K+ units were purchased in the past month.

Available in five stunning colors: Teal, Silver, Pink Dawn, Midnight Blue, and Blackout, this microphone is perfect for creators looking to produce exceptional audio. Priced at only $84.99, it’s a deal you can’t afford to miss.

Elevate your recordings with clear broadcast-quality sound and explore your creativity with enhanced effects, advanced modulation, and HD audio samples. Order now for just $84.99 on Amazon!

Help Power Techcratic’s Future – Scan To Support

If Techcratic’s content and insights have helped you, consider giving back by supporting the platform with crypto. Every contribution makes a difference, whether it’s for high-quality content, server maintenance, or future updates. Techcratic is constantly evolving, and your support helps drive that progress.

As a solo operator who wears all the hats, creating content, managing the tech, and running the site, your support allows me to stay focused on delivering valuable resources. Your support keeps everything running smoothly and enables me to continue creating the content you love. I’m deeply grateful for your support, it truly means the world to me! Thank you!