FAKE PRETTIER EXTENSION ON VSCODE MARKETPLACE DROPPED ANIVIA STEALER

Summary from the TLDR InfoSec newsletter

Checkmarx Zero identified and removed a malicious VSCode extension, "prettier-vscode-plus," within 4 hours of publication, limiting the impact to 6 downloads and 3 installs before removal. The brandjacking attack deployed Anivia Stealer (likely rebranded ZeroTrace, sold as MaaS for €120/month) using fileless execution from memory and sandbox evasion techniques to steal Windows credentials, data, and WhatsApp chats. Security teams should implement extension vetting controls and monitor developer tool installations, as supply chain attacks targeting IDEs increasingly aim to compromise source code and credentials.