Cryptojacking via VS Code: Hidden Crypto Miners Found in 300K Devices

A large-scale cryptojacking campaign has been discovered using malicious Visual Studio Code (VS Code) extensions. According to cybersecurity researchers at the startup ExtensionTotal, unknown attackers have published several harmful extensions in Microsoft’s popular code editor, aiming to secretly mine cryptocurrency on users’ devices.

Over 300,000 Installs in Just Days

In a detailed report, researchers revealed that at least nine malicious extensions were uploaded to the official VS Code Marketplace after April 4. These extensions were created by three different authors, with one name — “Mark H.” — being the most active.

Shockingly, these malicious extensions were downloaded more than 300,000 times within just three days. The most downloaded extension, titled “Discord Rich Presence,” alone gathered 189,000 installs.

ExtensionTotal co-founder Itay Kruk, a former product manager at Zscaler, explained that all nine extensions are fake and part of a coordinated cryptojacking campaign. These extensions act as the initial access point in a multi-stage attack that secretly installs cryptocurrency mining software.

“The extensions appear legitimate, but they’re actually tools for launching a hidden attack,” Kruk said.

Fake Extensions Used in the Attack

Here are the nine malicious extensions identified so far:

• Discord Rich Presence for VS Code

• Claude AI

• Golang Compiler

• Rust Compiler for VSCode

• ChatGPT Agent for VSCode

• HTML Obfuscator for VSCode

• Python Obfuscator for VSCode

• Rojo – Roblox Studio Sync (published by ‘evaera’ with 117,000 installs)

• Solidity Compiler (published by ‘VSCode Developer’ with 1,300 installs)

Most of these were uploaded by “Mark H.” The high number of downloads in such a short time suggests that the attackers used bots or other methods to fake install counts. This tactic helps gain trust by making the extensions seem popular and widely used.

“These inflated numbers highlight a serious weakness in how users measure trust on the marketplace,” Kruk noted.

How the Cryptojacking Attack Works

Once installed, these extensions silently download a PowerShell script that performs several harmful actions:

1. Disables Windows Security Features

2. Sets Up Persistence using scheduled tasks

3. Downloads and Runs XMRig, a popular cryptomining tool

The malware connects to a remote command-and-control (C2) server, which was registered on the same day the campaign began — April 4. The C2 domain used is asdf11[.]xyz.

XMRig is a widely known, open-source tool that mines Monero (XMR) and other privacy-focused cryptocurrencies. It is often abused by attackers in cryptojacking attacks because it is easy to set up and works efficiently in the background without user consent.

Silent But Sophisticated

What makes this attack more dangerous is the level of deception used. The malicious extensions not only include harmful code but also install the real versions of the extensions they pretend to be, which helps avoid suspicion from users.

All nine extensions share the same core code, contact the same C2 server, and download identical malware, clearly pointing to a single coordinated operation.

“This is one of the most sophisticated campaigns we’ve seen in the VS Code ecosystem,” Kruk said.