MALICIOUS VSCODE EXTENSIONS ON MICROSOFT'S REGISTRY DROP INFOSTEALERS

Summary from the TLDR InfoSec newsletter

Researchers have discovered two malicious extensions for VSCode that masquerade as a theme and an AI assistant, respectively, to drop infostealers. The extensions run a script that uses curl to download a malicious DLL, which executes as runtime.dll. The infostealers collect running processes, clipboard content, WiFi credentials, system information, screenshots, lists of installed programs, cookies from Chrome and Edge browsers, and cryptocurrency wallet passwords and credentials.