'Ransomvibing' Infests Visual Studio Extension Market

A security researcher note describes how a published Visual Studio Marketplace extension, labeled as “ransomvibing,” encrypts and exfiltrates data and does not hide AI-generated signs. According to Alexander Culafi, the extension was published to Visual Studio Marketplace by “susvsex,” presumably from a publisher named “suspublisher18,” and was described as capable of automatically zipping, uploading and encrypting files to a remote C2 server.

John Tuckner, founder of Secure Annex, published a research blog post on 4 November 2025 about what he called vibe-coded ransomware and noted several giveaways that the code was likely generated by an AI model, including extensive inline comments and hardcoded decryptors. The piece also highlights that the malicious extension created a private GitHub repository as a C2 channel and logged steps of its execution, which Tuckner said would aid victims in following its activity.

A Microsoft spokesperson told Dark Reading that the extension has been removed from the Marketplace, and that Microsoft can block Marketplace access at the firewall level; they added that when a malicious extension is reported and verified, it is removed from the Marketplace and uninstalled by VS Code, according to Microsoft Security Response Center.