Rogue Prettier Extension on VSCode Marketplace Deploys Anivia Stealer

Rogue Prettier Extension on VSCode Marketplace Deploys Anivia Stealer

First seen 25 Nov 2025, 18:29 UTC •HackreadGbhackers •88% similarity •42.5

Article Content

Browse articles
ThreatCluster

A malicious extension named 'prettier-vscode-plus' was removed from the VSCode Marketplace after being identified as a Brandjacking attempt. This extension was designed to deploy Anivia Stealer malware, targeting Windows users to steal credentials and sensitive data. The removal was conducted by Checkmarx Zero in collaboration with Microsoft.

ThreatCluster AI How this analysis works

Extracted Entities

1 / 2

Community

Browse all →

Tracked Entities in This Story

Anivia Stealer VSCode Marketplace Windows