“Evelyn Stealer” Weaponizes Visual Studio Code Extensions

Trend Micro analysis details the "Evelyn Stealer" campaign that weaponizes Visual Studio Code extensions to deliver a multi-stage information‑stealing malware. The campaign deploys loaders, uses process hollowing and DLL injection, employs AES-256-CBC encryption and anti-analysis techniques, and steals browser credentials, cryptocurrency data, screenshots, Wi‑Fi and clipboard information—targeting developers who often hold privileged access to production systems and cloud infrastructure.