Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data

Summary: Manifold Security found 77 "evil twin" extensions on the Open VSX marketplace, uploaded between July 26 and August 1, 2026, that impersonated real Microsoft VS Code Marketplace extensions and sent data to mangorbit[.]com, a domain registered July 15, 2026. All 77 were removed as of August 3, 2026; 58 sent little more than the machine's hostname, while 19 sent the hostname, OS username, editor name and version, machine ID, platform, architecture, locale, timezone, and the open workspace's folder name and full file system path.
Key Takeaway: The recon variant retries at roughly fifteen minutes, fifty minutes and three and a half hours, then every seven or eight hours, resuming on each editor restart and giving up only after seven days - so a machine that is offline, firewalled, or behind a proxy that drops the first request keeps getting asked for a week. It also checks whether a workspace's devcontainer.json or .vscode/extensions.json references the extension's ID, distinguishing installs a repository's configuration caused from installs a human chose.

Read the original at The Hacker News ↗