Malicious Microsoft VSCode extensions target devs, crypto community

Researchers discovered a campaign of 18 malicious VSCode extensions (and an associated npm package) that impersonated legitimacy with fake reviews and downloads, then deployed obfuscated downloader code to retrieve AES-encrypted CMD/PowerShell payloads from suspicious domains; secondary payloads were observed on test systems and some dropped binaries were flagged by multiple antivirus engines, with SHA1 indicators published to help detection and mitigation.