Malicious VSCode extensions on Microsoft's registry drop infostealers

Two malicious VS Code extensions published as Bitcoin Black and Codo AI (under the developer name 'BigBlack') were found on the Visual Studio Code Marketplace; they used activation events and scripts (PowerShell/batch with curl) to download a legitimate Lightshot executable and a malicious DLL loaded via DLL hijacking to deploy an infostealer named runtime.exe that captures screenshots, credentials, cookies (by launching browsers headlessly), and cryptocurrency wallets, storing data in an '%APPDATA%\Local\Evelyn' directory. Microsoft has since removed the extensions.