TigerJack's Malicious VSCode Extensions Steal Code, Mine Crypto, and Plant Backdoors

A threat actor known as TigerJack has been systematically infiltrating developer marketplaces with malicious Visual Studio Code (VS Code) extensions, creating a sophisticated attack infrastructure that steals source code, hijacks system resources for cryptocurrency mining, and establishes remote backdoors for complete system control.

This ongoing campaign highlights a critical and escalating threat to the software supply chain, leveraging the trust developers place in popular IDE marketplaces.

Malicious Extension Arsenal

TigerJack operates a coordinated multi-account campaign across at least three publisher identities (`ab-498`, `498`, and `498-00`), deploying at least 11 malicious extensions.

The most successful ones, "C++ Playground" and "HTTP Format," infected over 17,000 developers before being removed from the Microsoft Marketplace, though they remain available on the open-source OpenVSX registry (used by Cursor, Windsurf, and other VS Code-compatible IDEs).

The attack employs a "Trojan Horse" strategy: the extensions function as advertised to avoid suspicion while malicious code runs invisibly in the background.

Extension Name	Primary Malicious Function	Key Technique
C++ Playground	Source code theft	Exfiltrates C++ code via document change listener
HTTP Format	Cryptocurrency mining	Runs CoinIMP miner with hardcoded credentials
cppplayground, httpformat, pythonformat	Remote Code Execution (Backdoor)	Fetches & executes remote JavaScript payloads every 20 minutes

A Multi-Faceted Attack on Developers

Real-Time Source Code Theft: The "C++ Playground" extension uses an `onDidChangeTextDocument` listener that activates 500 milliseconds after a keystroke, capturing and exfiltrating complete C++ source files in near-real-time to multiple remote servers. The stolen code, often containing proprietary algorithms and intellectual property, is packaged into JSON payloads and sent to endpoints like `https://ab498.pythonanywhere.com/test4`.

Cryptojacking and System Hijacking: "HTTP Format" secretly runs a CoinIMP miner, using hardcoded API credentials to monopolize CPU resources. This causes noticeable performance issues like constant fan noise and system lag, which developers often mistake for hardware or software problems. The threat actor can monitor mining progress and withdraw mined cryptocurrency directly.

Persistent Remote Backdoor: The most dangerous extensions establish a persistent backdoor that polls a remote server (`https://ab498.pythonanywhere.com/static/in4.js`) every 20 minutes for new commands. Using JavaScript's `eval()` function on the fetched code, TigerJack can dynamically push any malicious payload without updating the extension. This allows for:

Stealing credentials and API keys
Deploying ransomware
Using developer machines as entry points into corporate networks
Injecting backdoors into software projects

A Persistent & Evolving Threat

TigerJack demonstrates high persistence. As recently as September 2025, the actor launched a coordinated republication campaign, repackaging the same malicious code under the new "498-00" publisher account. This occurred even as the investigation was ongoing, proving the operation's sophistication.

This campaign is part of a broader trend of attacks targeting developers through their tools. Recent incidents include a malicious dependency in the "Material Theme" that impacted nearly 4 million users, a cryptojacking campaign impersonating popular tools like "Prettier" and "Discord Rich Presence", and a supply chain attack on the "Ethcode" extension via a malicious pull request.

How to Protect Your Development Environment

For individual developers and organizations, vigilance and proactive security measures are critical:

Vet Extensions and Publishers: Only install extensions from verified, well-known publishers. Scrutinize the publisher's name, history, and other extensions.
Practice Least Privilege: Grant extensions only the minimum permissions they require. Regularly audit installed extensions and revoke access for those no longer in use.
Monitor System Performance: Unexplained high CPU usage or system slowdown could indicate a hidden cryptominer.
Use Security Tools: Consider community-built security scanners like ExtensionTotal that can detect malicious or risky extensions before they cause harm.
Maintain Visibility: Organizations should have visibility into third-party vendors and tools integrated into their development environment, as limited visibility is a major risk factor.

The TigerJack campaign serves as a stark reminder that the very tools intended to boost productivity can become potent weapons in the hands of threat actors. As the attack vector evolves, a shift from blind trust to verified security becomes not just prudent, but essential for safeguarding intellectual property and infrastructure.

TigerJack's Malicious VSCode Extensions Steal Code, Mine Crypto, and Plant Backdoors

Related threat feeds

Daxin Malware Resurfaces in Taiwan Alongside Novel Stupig Backdoor After Decade Long Silence

Malicious Extension Arsenal

A Multi-Faceted Attack on Developers

A Persistent & Evolving Threat

How to Protect Your Development Environment

148 Malicious npm Packages Used to Build a Browser Based DDoS Botnet

Pakistan Law Enforcement Agencies Targeted in Alleged Multi Group Cyber Espionage Operations