WHITECOBRA FLOODS VSCODE MARKET WITH CRYPTO-STEALING EXTENSIONS

Summary from the TLDR InfoSec newsletter

A threat actor named WhiteCobra has been flooding the VSCode marketplace and OpenVSX registry with malicious extensions targeting VSCode, Cursor, and Windsurf users. The extensions contain an extension.js file that is nearly identical to the Hello World example but loads a prompt.js file, which downloads and executes a platform-specific infostealer payload from Cloudflare Pages. An Ethereum core developer reported on X that their wallet was drained after downloading a seemingly legitimate extension with a professional logo, detailed description, and 54K downloads.