‘SleepyDuck’ Malware in Open VSX Lets Attackers Remotely Control Windows PCs

Security researchers have identified SleepyDuck as a remote access trojan hidden in the Open VSX IDE extension marketplace, targeting developers using code editors such as Cursor and Windsurf. The malicious extension masqueraded as a legitimate Solidity tool under the name juan-bianco[.]solidity-vlang, and it had racked up over 14,000 downloads before the payload was injected.

The attack unfolded in two stages: it was published on 31 October as a harmless tool, and on 1 November a critical update to version 0.0.8 introduced remote access capabilities, with a delayed activation that helped it gain a foothold on thousands of systems. SleepyDuck employs evasion techniques including sandbox detection and anti-analysis measures, and once activated it collects system information and communicates with command and control servers every 30 seconds.

Notably, the attackers implemented a blockchain-based failover mechanism, with the primary C2 domain sleepyduck[.]xyz registered on 1 November at 19:14:54 UTC and an Ethereum smart contract used to retrieve updated C2 addresses. The campaign has persisted across multiple updates and emphasises the risk to developers’ supply chains when extensions are trusted in marketplaces.