Anivia Stealer spread via bogus VSCode extension

HackRead reports that the widely used coding tool Prettier Code formatter has been spoofed on the VSCode Marketplace to enable Anivia Stealer malware injections on Windows systems as part of an attempted Brandjacking attack.

Only a few users were affected by the intrusion following Microsoft and the VSCode Marketplace's immediate takedown of the fake Prettier Code extension, according to Checkmarx Zero, which reported the malicious tool. Analysis of the illicit extension showed a multi-stage attack facilitating the covert in-memory execution of Anivia Stealer, which pilfered credentials, WhatsApp chats, and other sensitive data, said researchers.

Anivia Stealer, which was previously reported by ThreatMon to have been offered as a malware-as-a-service platform, has also been embedded with code that allows discovery of execution in sandbox environments. Despite the removal of the phony extension, developers have been urged to be more discerning in downloading tools, particularly from third-party marketplaces, to curb potential compromise.