Malicious VSCode Extension Launches Multi-Stage Attack Chain with Anivia Loader and OctoRAT

This report details a November 2025 supply-chain attack where a malicious VSCode extension named "prettier-vscode-plus" delivered a multi-stage infection chain (VBScript dropper, PowerShell loader, Anivia loader, and OctoRAT RAT), enabling browser credential and wallet theft, full remote access, persistence via scheduled tasks, privilege escalation (FodHelper UAC bypass), process hollowing into vbc.exe, and a web-based OctoRAT control panel; the analysis includes technical decomposition, MITRE ATT&CK mapping, IOCs (file hashes), and internet-wide C2 fingerprinting.