TigerJack Hackers Target Developer Marketplaces with 11 Malicious VS Code Extensions

TigerJack Hackers have targeted developer marketplaces with 11 malicious Visual Studio Code extensions, infiltrating the accounts of three publishers (ab-498, 498, and 498-00) and compromising more than 17,000 developers worldwide. The two most successful extensions, “C++ Playground” and “HTTP Format,” were quietly removed from Microsoft’s VS Code marketplace after months of operation, but continue to operate in the OpenVSX marketplace, which powers other IDEs such as Cursor and Windsurf.

Investigations reveal that the threat Actors republished the same malicious code under new names in Microsoft’s marketplace, demonstrating the campaign’s persistence. The extensions function as described while in use: the C++ Playground extension captures source code and transmits it to endpoints, and the HTTP Format extension mines cryptocurrency with hardcoded mining credentials, affecting machine performance.

A third set of extensions under the 498 publisher account contains remote code execution capabilities to establish backdoors, allowing the attacker to issue commands every 20 minutes and download arbitrary JavaScript from TigerJack’s server. The operation also employed professional social engineering, using GitHub repositories and branding to appear legitimate, and a republication campaign began on 17 September 2025.