Malicious AI VS Code Extensions With 1.5M Installs Steal Source Code, Secrets, and Developer Profiles

What happened

Researchers identified two VS Code Marketplace extensions marketed as AI coding assistants that secretly collect developer data and transmit it to attacker-controlled infrastructure. The extensions remain functional and deliver the promised AI assistance, which is a key part of the deception. The undisclosed behavior is the real issue: silent collection of file contents, change events, and user profiling data that can expose proprietary code and embedded secrets.

The campaign has been tracked under the name MaliciousCorgi and is linked by shared code and shared backend infrastructure across both extensions.

The malicious extensions (names, publishers, scale)

At the time of reporting, the two extensions were:

Combined, this places the exposure at approximately 1.5 million installations, which is unusually high for a malicious extension incident and makes it relevant for both individual developers and enterprise security teams.

What data is at risk

VS Code workspaces frequently contain high-value material, including:

If exfiltration occurs, the impact is not limited to a single machine. Stolen secrets can enable downstream compromise of Git repositories, CI runners, cloud subscriptions, production services, and customer data environments.

How the data theft works (three parallel channels)

The extensions implement three distinct collection channels that run alongside the legitimate AI assistance features.

Channel 1: Real-time file monitoring (open and edit)

As soon as a developer opens a file in VS Code, the extension reads the entire file contents, encodes it (Base64), and transmits it via a hidden webview mechanism. This triggers on file open, not only on active editing. Changes are also captured as you type, enabling continuous exfiltration of code in motion.

Channel 2: Server-controlled workspace harvesting (up to 50 files)

A second mechanism allows the remote server to trigger stealth collection of up to 50 files from the workspace. This is important because it reduces attacker dependence on what the victim happens to open. It turns exfiltration into an on-demand capability controlled by the operator.

Channel 3: Profiling and fingerprinting inside the editor

The extensions embed a zero-pixel iframe inside a webview to load commercial analytics SDKs, effectively tracking user behavior and device identity signals from within the IDE.

The result is a richer profile of the developer and their activity, not just their code.

Why VS Code extensions are a high-trust attack surface

VS Code's extension host runs extensions with the same effective permissions as the editor itself. That means an extension can:

• Read and write files
• Make network requests
• Run processes

This is exactly why malicious extensions are such a powerful supply chain vector: once installed, they sit in the developer workflow and observe high-signal data all day.

Workspace Trust helps reduce risk when opening unfamiliar repositories, but it is not a complete safety boundary against a malicious extension. Enterprise security cannot rely on prompts and trust dialogs as primary controls. It needs enforceable policy.

Immediate actions (do these now)

1) Identify and remove the extensions

On developer endpoints, check installed extensions and remove anything matching the suspicious identifiers.

Quick check (local machine):

code --list-extensions | findstr /i "whensunset.chatgpt-china zhukunpeng.chat-moss"

If present, uninstall:

code --uninstall-extension whensunset.chatgpt-china
code --uninstall-extension zhukunpeng.chat-moss

Then close all VS Code windows and relaunch to ensure the extension host is restarted.

2) Assume secret exposure and rotate credentials

If the extensions were installed on machines that access sensitive repositories or cloud environments:

3) Hunt for evidence of exfiltration

Focus on workstation telemetry and DNS or proxy logs. If you have EDR, investigate unusual VS Code extension host network activity, especially connections that do not align with expected AI assistant endpoints.

4) Reduce future risk with extension governance

For organizations:

• Enforce allowlisting of approved extensions
• Prefer verified publishers and internal vetting
• Restrict Marketplace usage where feasible
• Monitor for unusual extension install spikes and newly trusted publishers

Microsoft notes that when malware is removed from the Marketplace, extensions can be blocked in VS Code and forced-uninstalled, but security teams should still implement prevention and detection because the dwell time before removal is the critical risk window.

Indicators of compromise (IOCs)

Use these as pivots for inventory and threat hunting.

Extension identifiers

Domain

Behavioral indicators

Practical hardening checklist for developer workstations

Closing

This incident is not just another "malicious extension" story. It demonstrates a mature tactic: deliver real functionality while quietly harvesting code and identity signals at scale.

If your security program treats developer tooling as out of scope, you are leaving a high-privilege, high-context environment unmanaged.

Extension governance, secret hygiene, and endpoint monitoring for developer devices are now baseline controls for modern enterprise defense.

Quick removal commands

Windows (PowerShell):

code --uninstall-extension whensunset.chatgpt-china
code --uninstall-extension zhukunpeng.chat-moss

macOS/Linux (Bash):

code --uninstall-extension whensunset.chatgpt-china
code --uninstall-extension zhukunpeng.chat-moss