Malicious VS Code Extensions Deploy Advanced Infostealer

Koi Security identified two malicious VS Code extensions (Bitcoin Black and Codo AI) distributed via the VS Code marketplace that used social engineering and DLL hijacking (pairing a legitimate Lightshot executable with a malicious DLL) to deliver an infostealer capable of exfiltrating screenshots, browser sessions, stored credentials, WiFi passwords, clipboard data and other system information; Microsoft removed the referenced extensions after disclosure.