- Two VSCode extensions exfiltrated sensitive user data to Chinese servers
- ChatGPT – 中文版 and ChatMoss had over 1.5 million installs combined
- Extensions used hidden iframes, commands, and SDKs to steal files and track activity
More than 1.5 million people may have had their sensitive data exfiltrated to Chinese hackers through two malicious extensions found on the VSCode Marketplace.
Security researchers at Koi Security said they discovered two malicious browser extensions in Microsoft’s Visual Studio Code (VSCode) Marketplace, the official Microsoft store for code editor add-ons.
The extensions were announced as AI-based coding assistants. In fact, they worked as advertised, giving users a simple and convenient way to access a Generative Artificial Intelligence (GenAI) tool to help with coding. However, the tools also uploaded sensitive data to a third-party server in China without telling users about it.
MaliciousCorgi
According to Koi, these are the addons in question, both of which are still available for download on the marketplace:
ChatGPT – 中文版 (Publisher: WhenSunset, 1.34 million installs)
ChatMoss (CodeMoss) (Publisher: zhukunpeng, 150,000 installs)
Koi says both are part of the ‘MaliciousCorgi’ campaign and both sent the stolen data to the same server.
To exfiltrate the data, they used three different mechanisms, it said. The first is via real-time monitoring of files opened in the VS Code client. As soon as the victim opens a file, its contents are encoded in Base64 and forwarded to the servers.
“The moment you open a file – don’t interact with it, just open it – the extension reads its entire content, encodes it as Base64 and sends it to a webview containing a hidden tracking iframe. Not 20 lines. The whole file,” the researchers explained.
The second mechanism is a server-side command that stealthily sends up to 50 files from the victim’s workspace, while the third is a zero-pixel iframe in the extension’s webview where commercial analytics SDKs are loaded. These SDKs track user behavior, build identity profiles, and monitor other activity.
Microsoft told Bleeping Computer it investigated the situation, but the add-ons are still available for download.
Via Bleeping Computer
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews and opinions in your feeds. Be sure to click the Follow button!
And of course you can too follow TechRadar on TikTok for news, reviews, video unboxings, and get regular updates from us on WhatsApp also.
