Threat Actors Using Malicious VSCode Extension to Deploy Anivia Loader and OctoRAT

A fake Visual Studio Code extension posing as the Prettier formatter briefly appeared in the VSCode Marketplace and, once installed, fetched an obfuscated VBScript dropper from a malicious GitHub repository; that dropper wrote a Base64/AES PowerShell loader which decrypted and executed an intermediate Anivia loader that injected and launched the OctoRAT remote access trojan, enabling persistence, remote control, and theft of browser and wallet data from high-value developer systems.