Evelyn Stealer Malware Abuses VS Code Extensions to Steal Developer Credentials and Crypto

Cybersecurity researchers have detailed Evelyn Stealer, a new information stealer that targets software developers by weaponising the Visual Studio Code extension ecosystem to exfiltrate credentials and cryptocurrency data, according to Trend Micro. The campaign singles out organisations with software development teams relying on VS Code and third‑party extensions, and those with access to production systems, cloud resources, or digital assets.

Details from Koi Security’s December 2025 disclosure identified three VS Code extensions—BigBlack[.]bitcoin-black, BigBlack[.]codo-ai, and BigBlack[.]mrbigblacktheme—that dropped a downloader DLL, Lightshot.dll, which launched a hidden PowerShell command to fetch a second‑stage payload called runtime.exe, with the main stealer injected into the legitimate process grpconv.exe in memory before exfiltration via FTP to server09.mentality[.]cloud as a ZIP file.

The malware collects clipboard content, installed apps, cryptocurrency wallets, running processes, desktop screenshots, stored Wi‑Fi credentials, system information, and cookies from Chrome and Edge, while employing safeguards to detect analysis and terminate browser processes to avoid interference, and it uses a mutex to ensure only one instance runs at a time, Trend Micro noted.

The report also mentions two Python‑based families, MonetaStealer and SolyxImmortal, with SolyxImmortal using Discord webhooks for data exfiltration, highlighting a broader trend of attacker focus on developer ecosystems.