Threat Actors Exploit VS Code Extensions for Ransomware via GitHub C2

Gbhackers •Mayura Kathir • November 6, 2025

GBHackers on Security is a top cybersecurity news platform, delivering up-to-date coverage on breaches, emerging threats, malware, vulnerabilities, and global cyber incidents.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ransomware Deployment via VS Code Extensions and GitHub C2 Exploited Threat actors are exploiting vulnerabilities in Visual Studio Code (VS Code) extensions to deploy ransomware, using GitHub as a command and control (C2) server. This tactic poses risks to developers and organizations utilizing these extensions, potentially leading to significant data breaches and financial losses. 2 sources 47

Extracted Entities

Threat Actors Exploit VS Code Extensions for Ransomware via GitHub C2

The full story

Extracted Entities

Attack Types (1)

Platforms (2)

Tools (1)