Malicious VS Code Extensions Disguised as Dev Tools Hide Backdoors and Shellcode
cyb3rops · x · 2026-08-13
Security firm Knostic has uncovered a malicious VS Code extension campaign dubbed SaassyCode. Attackers distributed extensions disguised as Trello and Roblox development tools (e.g., TrelloWorks.trello-board and ManageRBLX) via the VS Code marketplace.
These extensions silently download and execute a BAT loader upon startup, establish persistence via scheduled tasks, and inject embedded shellcode into trusted Windows processes. The extensions have since been removed.
More from coding & agent
- Dispatch launches newsletter infrastructure built for AI agents, one API call to publish — RichardsonDx · 2026-10-16
- Hyperbrowser launches macOS sandboxes giving agents desktop, apps and Terminal control — madhavsinghal_ · 2026-10-16
- Creator shares the agent-powered system behind millions of monthly impressions — VibeMarketer_ · 2026-10-16
- Devs say LLM coding mistakes are a different class: overcomplication, inferred limits, worse at higher reasoning — Mu5_ · 2026-10-16
- How do you debug bad agent runs when you already have tracing? — Sensitive-Parsnip-12 · 2026-10-16
- Where does pre-task context live for agents? Devs debate workflows beyond handoff — shishen2026 · 2026-10-16