19 Malicious VS Code Extensions Disguised as PNG Files Detected

Hackread

19 Malicious VS Code Extensions Disguised as PNG Files Detected

First seen 11 Dec 2025, 18:52 UTC • •37.6

Article Content

1 / 3

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

ReversingLabs identified 19 malicious Visual Studio Code extensions that conceal trojans within fake PNG files. Developers using these extensions are at risk of malware infection through a popular dependency. The extensions were found in the VS Code Marketplace, prompting a security alert for users.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 210d ago How this analysis works

More articles in this cluster (2)

Threat Graph

4 entities, 4 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Malware
Trojan

Affected Platform (2)

Visual Studio Code
VS Code Marketplace

Relationships

Malware targets Visual Studio Code
Malware targets VS Code Marketplace
Trojan targets Visual Studio Code
Trojan targets VS Code Marketplace

Continue Reading

Critical Authentication Bypass in Rejetto HFS Exploited Within 24 Hours Anthropic's Mythos model identified a critical authentication bypass in Rejetto HTTP File Server (HFS), tracked as CVE-2026-61500, allowing remote code execution. Discovered by Horizon3 researcher Zach Hanley, the flaw was revealed on September 27, 2026, and exploitation began within 24 hours, with attacks traced to…

Critical Citrix NetScaler Zero-Day Vulnerabilities Exploited In late September 2026, two critical zero-day vulnerabilities (CVE-2026-88771 and CVE-2026-88772) in Citrix NetScaler ADC and Gateway were actively exploited, allowing remote code execution. The Cybersecurity and Infrastructure Security Agency (CISA) added these CVEs to its Known Exploited Vulnerabilities catalog on…