Back Hackread

Fake Prettier Extension on VSCode Marketplace Dropped Anivia Stealer

Hackread •Deeba Ahmed • November 24, 2025

Cybersecurity firm Checkmarx Zero, in collaboration with Microsoft, removed a malicious 'prettier-vscode-plus' extension from the VSCode Marketplace. The fake coding tool was a Brandjacking attempt designed to deploy Anivia Stealer malware and steal Windows user credentials and data.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Rogue Prettier Extension on VSCode Marketplace Deploys Anivia Stealer A malicious extension named 'prettier-vscode-plus' was removed from the VSCode Marketplace after being identified as a Brandjacking attempt. This extension was designed to deploy Anivia Stealer malware, targeting Windows users to steal credentials and sensitive data. The removal was conducted by Checkmarx Zero in collaboration with Microsoft. 2 sources 43

Extracted Entities

Fake Prettier Extension on VSCode Marketplace Dropped Anivia Stealer

The full story

Extracted Entities

Attack Types (2)

Companies (1)

Malware (1)

Platforms (1)