Critical VS Code Extension Backdoor Deploys RAT and Stealer

Key Takeaways

• A widely used Visual Studio Code extension, fast-draft, was backdoored to deploy a remote access trojan (RAT) and an information stealer on developer machines.
• Specific versions (0.10.89, 0.10.105, 0.10.106, 0.10.112) contained malicious code, impacting potentially thousands of developers through the Open VSX registry.
• The malware stole browser credentials, cryptocurrency wallet data, sensitive files, and clipboard contents, indicating a sophisticated supply chain attack targeting developer environments.
• A fix is not explicitly mentioned, but removing the malicious versions and rotating credentials is critical.

Malicious VS Code Extension Deploys RAT and Stealer on Developer Systems

A critical security vulnerability has emerged within a popular code editor extension available on the Open VSX registry, exposing developers to a sophisticated supply chain attack. The compromised extension, named fast-draft, operating under the KhangNghiem publisher account, was found to silently install a remote access trojan (RAT) and an advanced information stealer on unsuspecting developer workstations.

Before its malicious nature was uncovered, the fast-draft extension had amassed over 26,000 downloads, with specific releases containing the embedded malware responsible for the widespread compromise.

Attack Vector: Intermittent Malicious Injections

The attack unfolded through a calculated pattern of malicious code injection across several distinct versions. Researchers identified that versions 0.10.89, 0.10.105, 0.10.106, and 0.10.112 of the extension harbored code designed to connect to a GitHub repository controlled by a threat actor known as BlokTrooper.

This malicious code would fetch platform-specific shell scripts directly from raw.githubusercontent[.]com/BlokTrooper/extension. Critically, the retrieved scripts were then piped directly into a system shell, enabling the download and execution of a full second-stage malware payload on the victim’s machine.

Interestingly, other versions, including 0.10.88, 0.10.111, and the most recent 0.10.135, did not exhibit this malicious behavior. This alternating pattern strongly suggests that the attacker gained intermittent access to the publisher account or managed to steal a release token, rather than the extension maintainer intentionally turning malicious.

Discovery and Disclosure

Analysts at Aikido identified the compromised extension during a meticulous, manual review of the fast-draft release history. The research team publicly disclosed the issue to the extension’s maintainer on March 12, 2026, via a GitHub issue, though no response had been received at the time of publication.

Impact and Scope of Compromise

The implications of this compromise are severe and far-reaching. Any developer who installed one of the malicious versions unwittingly granted the attacker complete control over their system. The second-stage payload was designed to run four distinct attack modules concurrently, simultaneously targeting browser credentials, cryptocurrency wallet data, local files, source code, and clipboard contents.

With 26,594 recorded downloads on the Open VSX registry, the potential exposure to open-source developers and software development teams globally is substantial, highlighting a significant supply chain risk.

The inherent danger lies in the malware’s ability to camouflage itself within a tool that developers routinely trust and integrate into their daily workflows. Editor extensions typically operate with broad system permissions, making them prime targets for supply chain attacks. The “clean-and-malicious” version pattern further complicates detection, suggesting a sophisticated attacker with intermittent access to the release pipeline, a scenario that often evades purely automated scanning methods and necessitates thorough manual review.

Inside the Second-Stage Attack Framework

Upon execution, the shell downloader retrieved a ZIP archive, extracted its contents to a temporary directory, and then launched four independent Node.js processes. Each process was dedicated to a specific component of the multi-faceted attack.

• Module 1: Remote Control and C2 Communication: The first module established a connection to the command-and-control (C2) server at 195[.]201[.]104[.]53 over port 6931 using Socket.IO. This connection provided the attacker with real-time control over mouse movements, keyboard input, screenshot capture, and clipboard data exfiltration.
• Module 2: Credential and Crypto Wallet Theft: The second module systematically scanned browser profiles across Chrome, Edge, Brave, and Opera on Windows, macOS, and Linux, siphoning saved passwords and web data. It also specifically targeted 25 popular cryptocurrency wallet extensions, including MetaMask, Phantom, Coinbase Wallet, and Trust Wallet, uploading the collected data to port 6936 on the same C2 server.
• Module 3: Sensitive File Exfiltration: The third module recursively traversed the home directory, searching for critical documents, environment variables, private keys, shell history, and source code. Notably, it deliberately bypassed directories such as .cursor, .claude, and .windsurf, indicating a targeted focus on high-value AI-assisted developer environments.
• Module 4: Real-time Clipboard Monitoring: The fourth module continuously polled the clipboard every few seconds, capturing sensitive content like seed phrases, API keys, and passwords. This data was then transmitted directly to /api/service/makelog on the C2 server.

What You Should Do

• Immediate Removal: Developers must immediately check their installed VS Code extensions for fast-draft. If any version matching 0.10.89, 0.10.105, 0.10.106, or 0.10.112 is found, it should be removed without delay.
• Credential Rotation: All stored credentials, including browser passwords, cryptocurrency wallet seed phrases, and API keys, on any potentially affected machine should be promptly rotated. Consider assuming compromise and generating new keys/passwords.
• Network Monitoring and Blocking: Network teams should block all outbound traffic to the C2 server IP address 195[.]201[.]104[.]53 on ports 6931, 6936, and 6939. Additionally, monitor network logs for any requests to raw.githubusercontent[.]com/BlokTrooper.
• Security Best Practices: Re-evaluate the security posture of developer workstations. Implement robust endpoint detection and response (EDR) solutions and consider isolating critical development environments.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.