“Evelyn Stealer” Weaponizes Visual Studio Code Extensions

The article highlights a multi-stage espionage operation, named Evelyn Stealer, that weaponises the Visual Studio Code extension ecosystem to infiltrate development environments and harvest high-value data, according to Trend Micro. By disguising malicious payloads within seemingly helpful tools, the attackers treat the developer environment itself as the delivery mechanism.

Once installed, the malware deploys a complex infection chain involving loaders and process hollowing to execute the Evelyn Stealer payload, with the primary goal of harvesting credentials and other sensitive information from developers who hold privileged access.

The Evelyn Stealer is designed to be thorough, employing DLL injection to harvest browser credentials, snatch cryptocurrency data, capture screenshots, and steal Wi-Fi and clipboard information, while it uses AES-256-CBC encryption and multi-layered anti-analysis techniques to evade sandbox detection. The analysis notes the campaign’s disciplined technical approach and warns that more targeted attacks against developer communities are likely as AI-powered tools and third-party extensions expand the attack surface.

Security teams are advised to implement vetting processes for IDE extensions and to treat the developer’s laptop as a critical gateway.