Executive Summary
Between July 26 and August 1, 2026, researchers discovered a coordinated 'evil twin' campaign targeting the Open VSX marketplace. Attackers published 77 extensions that impersonated legitimate developer tools from major organizations like AMD, Microsoft Azure, and Salesforce. While the extensions were marketed as containing 'telemetry,' they lacked any actual functionality and were designed solely to harvest technical data from developer environments.
Technically, the campaign utilized two distinct payloads: a lightweight variant (58 extensions) that captured hostnames, and a high-fidelity reconnaissance variant (19 extensions) that exfiltrated sensitive Git and CI metadata. This included private repository paths, commit email domains, and environment variables from GitHub, GitLab, and Azure DevOps. The infrastructure used for exfiltration included several subdomains under mangorbit[.]com, with built-in resilience features like DNS TXT record lookups for fallback C2 addresses.
This campaign highlights the growing risk of 'extension confusion' where automated provisioning tools and AI agents may unknowingly pull malicious extensions by name. While the packages have been removed from the marketplace, they remain active on any systems where they were already installed, requiring manual intervention to mitigate potential long-term reconnaissance risks.